API keys & integrations
Administration ▸ API keys is organised into tabs, because two different things were sharing one page: credentials WE hold to reach somebody else, and credentials YOU issue to reach us. Connected services lists every external secret your workspace uses (AI/LLM, email, SMS and Stripe) with what each one powers, whether it is active, how recently it was set and an optional rotation-reminder date. Assistant access is the MCP key an outside AI assistant uses. Your API keys is a door through to Developer, where the keys you hand to Zapier, Make or your own code live. Platform staff see two more: AI routing and File scanning. Owners and admins only.
Read-only keys (v1.154.0): a key you issue for the REST API is READ ONLY by default. When you create one you choose Read only or Read and write, and you can change an existing key between the two at any time without reissuing it, so a reporting tool or a dashboard keeps working while losing the ability to change anything. Every scope change is recorded in the audit trail with who did it and when. Before v1.154.0 the console asked for both scopes and never offered the choice, so every key it had ever issued could write.
GoHighLevel bridge: run WorkBOS alongside GHL without double entry. In any GHL workflow add a Webhook action pointing to https://<your workspace domain>/functions-proxy/ghl-bridge (the URL is shown ready to copy on the Developer page, on whatever domain your workspace runs), and add a custom header X-WorkBOS-Key set to your API key. Contact events upsert CRM contacts by email (tagged lead source “gohighlevel”) and opportunity events create or update deals (open → Lead, won/lost mapped; idempotent, so repeated fires never duplicate). The key must have the write scope; calls are rate-limited per workspace and size-capped. Revoke the key any time to cut the bridge instantly.
Put the key in the header, not in the address. Older instructions said to use https://<your workspace domain>/functions-proxy/ghl-bridge?key=<your API key>, with the key on the end of the address. That still works until 5 November 2026 and then stops. An address is copied into GoHighLevel’s own workflow history and into every log between them and us, so the key ends up readable by people who were never meant to have it, and that key can read and change your whole CRM. If your workflow still has the key in the address, move it into a custom header called X-WorkBOS-Key (Authorization: Bearer <key> works too) and take it out of the address. Replies to a request that still carries the key in the address include a Deprecation header naming the date, so a script can spot it without anybody reading this page.
Security: secrets are stored encrypted server-side and are never displayed or sent to the browser, the page shows status only, never the key value. These provider keys carry no fixed expiry; rotate them periodically by re-entering the key on each integration’s manage page. You can also set a per-key rotation-reminder date on the page, it shows “due in Nd” as the date nears and “Overdue” once it passes. Admins also get a dashboard reminder when a key is overdue or due within 30 days.