GoHighLevel Marketplace apps: OAuth 2.0 & webhooks done right
GoHighLevel is a goldmine for agencies, and a Marketplace app can turn a one-off integration into a recurring revenue line. But the platform's OAuth and webhook surface has enough sharp edges that a lot of first submissions bounce. Most of the rejections we see come down to the same handful of mistakes — all avoidable once you know where to look.
Start with OAuth 2.0 and scopes. GHL issues access tokens that expire, paired with a refresh token, and the single most common production bug is treating the access token as if it lives forever. You need to store the refresh token securely, refresh proactively before expiry rather than reacting to a 401, and handle the case where a refresh itself fails because a user revoked access. Request only the scopes you actually use — over-asking is both a review flag and a trust problem with agencies installing your app.
Location-level versus agency-level installs trip people up constantly. An app can be installed at the agency level and then granted access to multiple sub-account locations, each with its own token context. If your data model assumes one token per install, you'll break the moment a real agency with twenty locations installs you. Model the token as belonging to a location, keyed by company and location ID, from day one.
Webhooks are where security gets real. GHL signs webhook payloads, and you must verify that signature on every inbound request before you trust a byte of it — otherwise anyone who learns your endpoint URL can forge events. Verify against the raw request body (not the parsed JSON, which can re-serialize differently), respond with a 200 quickly, and do the actual work asynchronously on a queue. Webhook handlers that do heavy synchronous work time out and get retried, which means duplicate processing unless your handler is idempotent.
The review itself rewards boring thoroughness. Reviewers test the full install-to-uninstall lifecycle, so handle the uninstall webhook and actually clean up — orphaned data and tokens that keep trying to refresh after uninstall are common rejection reasons. Have a real privacy policy, accurate scope justifications, and screenshots that match the live app. We keep a pre-submission checklist that walks the entire OAuth round trip, a forged-signature webhook test, and an uninstall test, because catching these before review is far cheaper than a rejection cycle.
Get the foundations right — durable token handling, location-aware data, verified idempotent webhooks — and the GHL Marketplace becomes a genuinely good distribution channel. The agencies are already there, already paying, and actively looking for tools that extend their stack. The bar is just "build it like you mean to run it in production," which is the bar anyway.