Jonathon's AI Wiki

Developer Marketplace

10 min read

Source: ai-research/ghl-2026-05-01/support-solutions-articles-155000000136-how-to-get-started-with-the-developer-s-marketplace.md, ai-research/ghl-2026-05-01/support-solutions-articles-155000002458-how-to-manage-developer-user-accounts.md, ai-research/ghl-2026-05-01/support-solutions-articles-155000002545-enhanced-account-security.md, ai-research/ghl-2026-07-02-drain/marketplace-docs-create-marketplace-app-versions.md, ai-research/ghl-2026-07-02-drain/marketplace-docs-create-developer-account-ownership.md, ai-research/ghl-marketplace-app-updates-versioning-changelog-2026-07-03.md

The Developer Marketplace at marketplace.gohighlevel.com is the home for everything related to building and shipping HighLevel apps — registering an app, configuring OAuth, defining scopes, picking a distribution model, setting pricing, and submitting for review. This article is the lap-around: the marketplace surface, how developer accounts work, the auto-created developer flow for agency admins, and the role-based access controls for team members. For the OAuth handshake itself see OAuth 2.0; for listing and distribution choices see Marketplace App Listing.

Key Takeaways

  • The Developer Marketplace is the developer-facing surface inside HighLevel where apps are registered, OAuth credentials are issued, scopes are picked, and the listing + pricing are configured before submitting for review.
  • Two access levels for OAuth apps: Location Level (per sub-account) and Agency Level (company-wide). The choice affects which scopes you can use and which token type the OAuth flow returns.
  • Apps are Public (listed in the marketplace, anyone can install) or Private (invite-only, capped at 5 agencies until you publish or pass security review).
  • An agency admin who clicks “Sell on Marketplace” without an existing developer account gets one auto-created in the background — the system creates a developer profile from the existing account, then prompts password + terms + email OTP to finish activation.
  • Developer accounts use Role-Based Access Control with three roles: Owner (one per account, full access, cannot transfer), Admin (manages other Admins/Users, cannot modify Owner), User (limited — view apps, manage apps, submit for review; cannot delete apps, view earnings, or manage users).
  • Enhanced Account Security has been the default since June 17, 2024. It disables auto-generation of location API keys, hides API keys from the Location CRUD API responses, and disables user CRUD via the legacy v1 API. Opt-out is possible in agency Settings but strongly discouraged.
  • Listing management is UI-only — no public API exists for creating/updating a Marketplace listing itself; every official flow runs through the Developer Portal.
  • Apps version like software releases, not silent hot-swaps — the Manage → Versions section is where you track and roll out changes deliberately.

What the Marketplace Gives You

When you sign up for a developer account at marketplace.gohighlevel.com and click “Create App,” you get:

  • An App ID — unique identifier shown under the app name in the developer dashboard
  • A Client ID and Client Secret for OAuth — generated when you create client credentials
  • Scope configuration — pick from the list at marketplace.gohighlevel.com/docs/Authorization/Scopes
  • Webhook URL configuration — your POST endpoint that receives event payloads
  • Redirect URI configuration — where HighLevel sends users after they authorize the app
  • Pricing setup, listing controls, distribution model, support links, app profile

Listing management is UI-only. Every official flow for creating or editing an app listing (profile, pricing, modules, scopes, redirect URLs, webhooks) runs through the Developer Portal UI at marketplace.gohighlevel.com — the official “Create a Marketplace App” walkthrough and every support article describe manual portal steps, never a “create listing” or “update listing” REST call. No public API for managing the listing itself (as opposed to runtime data like installs, webhooks, or OAuth tokens) was found across the official API docs index, the app-creation guide, or third-party integration guides. If you need to manage listing content programmatically, there is currently no documented path — treat this as a UI-only surface.

App Type: Public vs Private

TypeVisibilityInstallUse Case
PublicListed in the MarketplaceAny agency or sub-account with permissionApps you want to sell or distribute broadly
PrivateNot listed; invite-onlyCapped at 5 agencies until you go Public or pass Security ReviewInternal tools, pilot apps, single-customer integrations

The Private cap counts unique agencies, not sub-accounts. Once you reach 6 agencies, new installs are blocked until you publish the app or get Security Review approval.

Sell on Marketplace — Auto-Created Developer Accounts

For agency admins who haven’t already signed up at the developer portal: clicking Sell on Marketplace triggers an auto-create flow.

  1. HighLevel creates a developer profile in the background using existing agency account details.
  2. The admin is redirected to sign in.
  3. They’re prompted to: enter a password, accept the developer terms and conditions, and verify a one-time password sent by email.
  4. Once verified, they’re signed into the new developer account and continue the Marketplace listing flow.

No separate developer signup form is needed — the agency admin’s existing identity is reused.

Developer User Roles (RBAC)

A developer account can have multiple users, managed under Account → User Management. Three roles:

PermissionOwnerAdminUser
View appsYesYesYes
Create and manage appsYesYesYes
Delete appsYesYesNo
Submit for reviewYesYesYes
View app earningsYesYesNo
Create & manage usersYesYesNo
View app dashboardYesYesYes
  • Owner: the original signup. Only one per account. Full access. Ownership cannot be transferred — confirmed on the current official “Create a Developer Account” setup docs, worded identically to the support article: “There can be only one Owner… If you need multiple people to access the Developer Portal, add them as users (recommended) instead of sharing credentials.” No exception or support-intervention path is mentioned in either source. If a change of Owner is genuinely needed, the documented workaround is to add the new person as an Admin (same access as Owner short of modifying Owner details) rather than attempt a transfer.
  • Admin: same access as Owner except cannot modify Owner details.
  • User: limited to viewing/creating/managing/submitting apps. Cannot delete apps, see earnings, or manage other users.

To add a user: navigate to Account → User Management → Add User, enter their email, assign Admin or User, toggle individual permission overrides, click Submit. The user receives an activation email; they set a password and the account becomes active.

To remove a user: navigate to their profile in the Users section, click Remove User. Only Owners and Admins can delete users.

Enhanced Account Security

Default for all accounts since June 17, 2024. When enabled, it changes API behavior in three ways:

  1. Auto-generation of location API keys is disabled. When you create a new sub-account location (via UI or API), no API key is auto-generated. You must generate one manually through the UI.
  2. Location CRUD APIs no longer return API keys. Previously these endpoints exposed the location API key in the response. Now you must log in to the UI to retrieve it.
  3. Legacy v1 user APIs are disabled. The user create/update/delete endpoints on API v1 are turned off — these were the easiest path for an attacker holding a stolen API key to escalate access.

The setting also does not restore key generation for locations where the key was previously revoked — only locations with active keys benefit from the new defaults.

You can opt out under agency Settings, but the recommendation is to leave it on. See API Security for the broader API v1 deprecation context.

Distribution Type Quick Reference

When you create an app you also pick a Distribution Type — see Marketplace App Listing for full configuration options. Two legacy buckets:

  • Agency: app accessible to all agency-level admins; a single agency-wide install
  • Sub-Account: app installs against individual locations; bulk-install support is recommended for newer apps

The newer model uses three orthogonal fields (target user, who can install, bulk-install support) and replaces the older two-option choice — older apps are auto-mapped for backward compatibility.

App Versioning

Marketplace apps have a dedicated Versions feature under the app’s Manage section in the Developer Portal — you create and manage new versions of your app there rather than editing a single live listing in place. HighLevel’s own guidance: “Treat versions like real software releases. Track changes, test upgrades, and avoid breaking behavior without a migration plan.”

Resolved 2026-07-03 — existing installs do NOT auto-upgrade; they get an Update button. HighLevel’s official changelog (“Introducing App Updates with Versioning in the GHL Marketplace”) confirms the mechanics directly:

  • Version lifecycle: Draft (editable working copy) → In Review (submitted for review, public apps) → Live (approved, installable) → Deprecated (scheduled for removal) → Disapproved (rejected, editable like Draft). Limits: max 3 total versions per app; only one Draft/Disapproved at a time.
  • Semantic versioning on publish: developers pick Major (breaking/incompatible), Minor (backward-compatible enhancement), or Patch (bug fix only).
  • How an existing install actually updates: “When a new version goes Live: Installed apps show an Update button” and display version-specific release notes — “Major updates require explicit user confirmation” while “Minor and Patch updates follow a standard safe flow.” This is opt-in, not a silent push — the sub-account/agency has to act.
  • Deprecation is the one automatic case: when a Live version is deprecated (minimum 3-day notice), “all installs using that version are automatically uninstalled” on the deprecation date.
  • Before this release (legacy behavior, now superseded): new installs got the latest version automatically, but existing installs could not be upgraded at all — the only path was uninstall + reinstall, which lost configuration.

Custom Widgets and Custom JavaScript specifically fall outside this new system — this is the answer to the module-versioning question. The changelog has a dedicated “Module Update Behavior (Current State)” section: “Modules are currently associated with the app, not a specific version” and “Changes to module functionality may become visible immediately after saving.” In other words, unlike full app versions (which require an explicit Update click), a developer’s changes to a Custom Widget or Custom JavaScript module are not gated behind the Draft→Review→Live app-version lifecycle at all — they can go live immediately on save, with no confirmed re-review step and no “Update button” step for the installed sub-account. HighLevel’s own roadmap (“What’s Next”) lists “version-aware module updates” as not-yet-shipped — i.e., HighLevel itself confirms this gap exists as of this changelog. Practical implication: don’t assume a Custom Widget/Custom JS change is staged or reviewed the way an app version is; treat any save to a live module as effectively immediate and test in a private app first.

Try It

  • Sign up for a developer account at https://marketplace.gohighlevel.com (or click Sell on Marketplace from an agency admin account to trigger the auto-create flow).
  • Create your first app: click Create App, fill in profile, pick App Type (Public/Private) and Distribution Type, save.
  • Add scopes from marketplace.gohighlevel.com/docs/Authorization/Scopes matching what your app needs to do.
  • Generate Client ID and Client Secret in the app settings — store them securely; the secret is shown once.
  • Set the OAuthToken Redirect URL to the GET endpoint in your app that handles the OAuth callback.
  • Add team members under Account → User Management with Admin or User roles depending on what they need to do.
  • Verify Enhanced Account Security is on under agency Settings; if you disabled it, re-enable.
  • Join the Developer Council Slack at https://www.gohighlevel.com/dev-slack for real-time help.
  • Before inviting a second person onto your developer account, decide Admin vs User deliberately — since Owner status can never be transferred later, whoever signs up first is stuck as Owner for the life of the account.
  • Use the Manage → Versions section for any breaking change to a live app; write yourself a migration note before publishing a new version, since the docs treat this as a real release process, not a hot-swap.

Open Questions

  • The Security Review process for Private apps that want to stay Private past the 5-agency cap — the source mentions it as a path to lift the cap but doesn’t document the review criteria or SLA.

Graph View

Backlinks