From 9bdd266898508944b23b3c1aa636ed483176ec86 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 16:10:27 +0000 Subject: [PATCH 1/2] docs: clarify HighLevel public-app requirement and frontend API key exposure --- src/embeddable-ui-components.mdx | 6 ++++++ src/provider-guides/highlevel.mdx | 2 ++ 2 files changed, 8 insertions(+) diff --git a/src/embeddable-ui-components.mdx b/src/embeddable-ui-components.mdx index 2f55463e..fd607934 100644 --- a/src/embeddable-ui-components.mdx +++ b/src/embeddable-ui-components.mdx @@ -65,6 +65,12 @@ When you are first developing integrations with Ampersand, API keys are a quick You can create an API key on the [API keys page](https://dashboard.withampersand.com/projects/_/api-keys) of your Ampersand Dashboard. Select "UI Library" for "Where will you use the API key?" + +API keys passed to `AmpersandProvider` are bundled into your frontend and visible to anyone who inspects the browser's network requests or JavaScript. They are not time-bound and are not scoped to a specific end user, so a leaked key stays valid until you revoke it and can be used to access any customer's integration data. + +Use API key authentication only for local development or internal prototypes. For production, switch to [JWT authentication](#jwt-authentication) so signing stays on your backend and each token is short-lived and scoped to one `consumerRef` / `groupRef`. + + #### JWT authentication When you are ready to ship your integrations to production, we highly recommend that you move to JWT authentication, as it is more secure than using API keys in the frontend. JWT tokens are time-bound and also enforce that your users only have access to their own integration data. diff --git a/src/provider-guides/highlevel.mdx b/src/provider-guides/highlevel.mdx index 42e4dec9..3a9d2a21 100644 --- a/src/provider-guides/highlevel.mdx +++ b/src/provider-guides/highlevel.mdx @@ -107,6 +107,8 @@ Follow the steps below to create an HighLevel app and add the Ampersand redirect 4. Select **App Type**: Public, select **Distribution Type** and select the **Listing Type**. + You must choose **Public** as the App Type. Private apps do not support the OAuth redirect URL and client credential flow that Ampersand uses, so they cannot be connected. If you already created a Private app, create a new one with App Type set to Public. + 5. Click **Create App**. ![App creation](/images/provider-guides/highlevel.gif) From 562ba71ea10b0f6e048fad69306730342995e821 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 16:12:18 +0000 Subject: [PATCH 2/2] docs: add SEO descriptions to changed pages --- src/embeddable-ui-components.mdx | 1 + src/provider-guides/highlevel.mdx | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/embeddable-ui-components.mdx b/src/embeddable-ui-components.mdx index fd607934..6aac318a 100644 --- a/src/embeddable-ui-components.mdx +++ b/src/embeddable-ui-components.mdx @@ -1,5 +1,6 @@ --- title: "Prebuilt UI components" +description: "Embed Ampersand's React components for installing and managing integrations, and choose between API key or JWT authentication for the frontend." --- ## Project setup diff --git a/src/provider-guides/highlevel.mdx b/src/provider-guides/highlevel.mdx index 3a9d2a21..e13da116 100644 --- a/src/provider-guides/highlevel.mdx +++ b/src/provider-guides/highlevel.mdx @@ -1,5 +1,6 @@ --- -title: HighLevel +title: "HighLevel" +description: "Connect HighLevel to Ampersand: create a Public marketplace app, generate OAuth client credentials, and see which HighLevel objects support read and write." --- ## What's Supported