By Alpit Patel and the aibrevo team · October 22, 2026 · 6 min read
Why Is My GoHighLevel Private Integration Not Working?
Quick answer
Most failures trace to six causes: the token lacks a scope, the Authorization header or Version header is wrong, the token was rotated and the old one expired, you copied it wrongly because it is shown only once, the feature is hidden in Labs or Roles and Permissions, or an old v1 API key is being used. Each has a documented fix.
Key takeaways
- The 401 text people search for is "The token is not authorized for this scope." It means the integration was created without the permission that endpoint needs. Edit the integration's scopes (checked Oct 22, 2026).
- HighLevel's docs say editing the name, description or scopes does not generate a new token and the existing token keeps working. They do not say whether an existing token picks up a newly added scope, so test it and rotate if the 401 stays.
- A token is shown once. HighLevel says you cannot view it again after leaving the creation screen, so a lost token means rotating, not retrieving.
- Rotation has two modes: expire later gives a 7-day window in which both tokens work, and expire now cuts the old token off at once. HighLevel recommends rotating every 90 days.
- If Private Integrations is missing from settings, HighLevel points to Labs, and to Roles and Permissions, where agency admins have it by default but it can be restricted per user.
A private integration that stops working in GoHighLevel almost always fails for one of six reasons: a missing scope (the 401 reading “The token is not authorized for this scope”), a wrong header, a rotated token whose old copy expired, a token copied wrongly because HighLevel shows it only once, a hidden setting in Labs or Roles and Permissions, or an old v1 API key. Work through them in that order. The first is the most common in the forum reports we found, and the fix is two clicks.
Checked Oct 22, 2026 against HighLevel’s Private Integrations documentation and one HighLevel ideas-board thread that quotes the 401 text. We did not create a test integration, and the ideas-board thread has no HighLevel staff answer on the page we read, so the scope explanation below is our reading of the docs, not a HighLevel statement about that error.
How do I fix “The token is not authorized for this scope”?
The message is a 401 response: {"statusCode": 401, "message": "The token is not authorized for this scope."}. A user posted exactly that on HighLevel’s ideas board in March 2025 while using an agency-level private integration token and being unable to find the write scope they wanted. The reply on that page was another user saying “not sure,” so nothing official is attached to it.
HighLevel’s documentation does give the mechanism. When you create a private integration you pick the scopes (permissions) it needs, and the page advises choosing only the required ones. You can edit scopes later. So a request to an endpoint that needs a permission your integration does not carry should be refused, and the fix is to add that scope.
- Find the endpoint’s required scope in HighLevel’s API reference for that call.
- Open the private integration in settings and add that scope.
- Save, then send one request.
- If it still returns 401, rotate the token and put the new one in your app.
Step 4 exists because the docs say editing scopes does not produce a new token and the existing token keeps working, and they do not say when that token starts honouring a new scope. The page also does not list the available scopes, so the API reference is where the name comes from.
Which cause is it? Symptom to fix
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 “not authorized for this scope” on one endpoint, others work | Scope not added | Edit the integration, add the scope, test, rotate if needed |
| 401 on every call | Wrong or malformed Authorization header, or a wrong token | Send Authorization: Bearer <token> and the Version: 2021-07-28 header shown in the docs |
| Worked for months, now fails after a team change | Token rotated, old one expired | Update the app with the new token |
| “I never saved the token” | Token shown only once | Rotate, copy the new token at once |
| No Private Integrations menu | Labs switch off, or role restriction | Enable it in Labs, or ask an admin to change Roles and Permissions |
| Old script sends an API key | v1 key, end of life | Create a private integration and switch |
Source: HighLevel Private Integrations documentation, checked Oct 22, 2026, plus the ideas-board thread for the 401 text. The mapping from symptom to cause is our reading.
How does rotation break a working integration?
Rotation is the usual reason something works on Monday and fails on Friday. HighLevel’s page describes two modes:
- Rotate and expire this token later. This is the routine option. Both the old and the new token work for a 7-day window. During it you can cancel the rotation or expire the old token immediately.
- Rotate and expire this token now. For a compromised token. The old token stops working immediately, so update your app before or straight after.
Tokens are static, and HighLevel contrasts them with OAuth access tokens, which it says expire daily. A private integration token does not refresh itself. It only changes when someone rotates it. HighLevel recommends rotating every 90 days, so calendar the date, and keep a record of which app holds which token. After a 7-day window ends, a forgotten script using the old token fails with 401 and no other change on your side.
If you are choosing between a private integration and an OAuth marketplace app for a build, our GoHighLevel API guide compares them.
What if I lost the token or cannot find the setting?
The token is visible only on the creation screen. HighLevel’s page says you will not be able to view it again after you leave, so rotate to get a new one and copy it at once into a password manager or your app’s secret store. Do not paste it into chat threads or tickets.
If Private Integrations is not in your settings menu, the page gives two checks. First, enable the feature in Labs. Second, look at Roles and Permissions: agency admins can create integrations by default, but the permission can be restricted per user. The feature is available for both agencies and sub-accounts, so confirm you are looking at the level where you built it. Our user roles and permissions page covers how roles are set.
Could rate limits be the problem?
A 429 is a different failure from a 401. HighLevel’s OAuth documentation gives a burst limit of 100 API requests per 10 seconds and a daily limit of 200,000, counted per Marketplace app and per resource (Location or Company). Those pages do not say how the count applies to a private integration specifically, so we cannot state your exact allowance. Responses carry headers showing remaining budget, and HighLevel suggests reading them instead of counting calls yourself. Our CRM API rate limits comparison sets HighLevel’s numbers beside other CRMs.
One more cause worth ruling out: HighLevel’s page says API keys use v1.0, which has reached end of life, and grant unrestricted access. If a script or a no-code connector still sends a key, replace it with a private integration instead of debugging the key.
When to get help
Get help when an integration feeds a live system such as billing, booking or lead routing and a silent 401 would cost leads, when several tools share one token and nobody knows where it is used, or when you are deciding between a private integration and a marketplace app. A specialist can inventory the tokens, set the narrowest scopes, build the rotation routine and add alerting for failed calls. Book a short call or send a message, and see the GoHighLevel service page for what aibrevo builds.
Sources
All checked Oct 22, 2026.
- HighLevel Marketplace documentation, Private Integrations: creating an integration, scopes, header format, rotation and the 7-day window, Labs and Roles and Permissions, API key end of life.
- HighLevel Marketplace documentation, Rate limits: burst and daily limits and the rate-limit headers.
- HighLevel Ideas board, Agency level API: user report quoting the 401 text (March 14, 2025), opinion and report only.