Do I paste a Private Integration Token into Claude?
Not with NotFair. Official generic HighLevel MCP docs use Authorization and locationId headers. NotFair keeps credentials server-side after Marketplace OAuth.
GoHighLevel MCP · hosted OAuth
Connect HighLevel without putting a PIT in Claude
NotFair hosts HighLevel Marketplace OAuth. You authorize Company or Location access without pasting a Private Integration Token into the AI client.
Last verified · September 17, 2026 · NotFair product team
Marketplace app versus client headers
NotFair holds the HighLevel app; you grant the location
HighLevel’s generic MCP endpoint documents a Bearer token and locationId in the client config. NotFair’s hosted flow keeps those secrets on the server after Marketplace OAuth.
- 01
Add the hosted MCP URL
Use https://notfair.co/api/mcp/notfair in Claude or another compatible client.
- 02
Complete Marketplace OAuth
Sign in to HighLevel, pick Company or Location, and approve the documented scopes.
- 03
Return to Claude
The client stores a NotFair grant, not a HighLevel PIT.
- 04
List locations
Ask Claude to list reachable locations before mutating a contact.
- 05
Reauthorize if a scope is missing
A tool that needs a scope you did not grant will say so. Repeating the call will not create the permission.
- 06
Revoke from NotFair
Disconnect the HighLevel connection in the workspace. Claude does not keep a copy of the PIT.
Evidence table
Hosted OAuth versus official PIT headers
| Responsibility | NotFair hosted MCP | Official generic /mcp/ |
|---|---|---|
| Client secret material | NotFair OAuth grant | Private Integration Token in client headers |
| Location binding | Pinned connection + optional locationId | locationId header on every client config |
| Claude catalog | 36 GoHighLevel tools | 625 operations across 40 domains on /mcp/anthropic/v2 |
| Ads + CRM together | Same NotFair endpoint | HighLevel-only official MCP |
Limits and honest boundaries
- Hosted OAuth does not bypass HighLevel permissions or Marketplace app review.
- Official HighLevel MCP remains a valid choice when you want the first-party 625-operation Claude catalog.
- Missing scopes require a new Marketplace authorize — not a retry.
- Apex is canonical; www remains supported for existing grants.
Frequently asked questions
Is this HighLevel’s official MCP?
No. HighLevel publishes official endpoints, including a Claude-specific catalog. NotFair is an independent counted surface on /api/mcp/notfair.
Do both notfair.co and www.notfair.co work?
Yes. Apex is canonical for new setup; both origins remain valid OAuth and MCP resources.
Can I connect a Company (agency) account?
Yes. NotFair supports Company or Location connections. Agency calls should pass locationId.