Skip to content

Fill gaps from assistant conversations: HighLevel app type and frontend API key exposure #688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fill gaps from assistant conversations: HighLevel app type and frontend API key exposure #688

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9bdd266
docs: clarify HighLevel public-app requirement and frontend API key e…
mintlify[bot] Aug 10, 2026
562ba71
docs: add SEO descriptions to changed pages
mintlify[bot] Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/embeddable-ui-components.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
title: "Prebuilt UI components"
description: "Embed Ampersand's React components for installing and managing integrations, and choose between API key or JWT authentication for the frontend."
---

## Project setup
Expand Down Expand Up @@ -65,6 +66,12 @@ When you are first developing integrations with Ampersand, API keys are a quick

You can create an API key on the [API keys page](https://dashboard.withampersand.com/projects/_/api-keys) of your Ampersand Dashboard. Select "UI Library" for "Where will you use the API key?"

<Warning>
API keys passed to `AmpersandProvider` are bundled into your frontend and visible to anyone who inspects the browser's network requests or JavaScript. They are not time-bound and are not scoped to a specific end user, so a leaked key stays valid until you revoke it and can be used to access any customer's integration data.

Use API key authentication only for local development or internal prototypes. For production, switch to [JWT authentication](#jwt-authentication) so signing stays on your backend and each token is short-lived and scoped to one `consumerRef` / `groupRef`.
</Warning>

#### JWT authentication

When you are ready to ship your integrations to production, we highly recommend that you move to JWT authentication, as it is more secure than using API keys in the frontend. JWT tokens are time-bound and also enforce that your users only have access to their own integration data.
Expand Down
5 changes: 4 additions & 1 deletion src/provider-guides/highlevel.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
title: HighLevel
title: "HighLevel"
description: "Connect HighLevel to Ampersand: create a Public marketplace app, generate OAuth client credentials, and see which HighLevel objects support read and write."
---
## What's Supported

Expand Down Expand Up @@ -107,6 +108,8 @@ Follow the steps below to create an HighLevel app and add the Ampersand redirect

4. Select **App Type**: Public, select **Distribution Type** and select the **Listing Type**.

<Warning>You must choose **Public** as the App Type. Private apps do not support the OAuth redirect URL and client credential flow that Ampersand uses, so they cannot be connected. If you already created a Private app, create a new one with App Type set to Public.</Warning>

5. Click **Create App**.

![App creation](/images/provider-guides/highlevel.gif)
Expand Down
Loading