Build a read-only API or MCP connection (HighLevel and Follow Up Boss)

Why it matters

A CSV goes stale the moment you export it. A live connection keeps the daily list current, but a key that can write can also tag, enroll or delete. Read-only first means the worst outcome of a mistake is a wrong list, not a changed CRM.

Step by step

1. 01

   Write down the read-only boundary before creating any key

   Allowed	Not allowed
   Read contacts, tasks, conversations, pipelines, custom field definitions	Create, update or delete contacts
   Search and list	Add or remove tags, enroll in workflows
   Read message history	Send any message, email or call

   Check: Your boundary table is saved next to your job description from chapter 02.01.

2. 02

   HighLevel: create a View-only Private Integration Token

   1. Open Settings → Private Integrations. If you do not see it at the agency level, HighLevel says to enable it under Labs. PITs are also available for sub-accounts.
   2. Click Create new Integration. Name it Grok CRM Manager (read-only) and add a description with today's date.
   3. Select View scopes only: View Contacts, View Conversations, View Conversation Messages, View Opportunities, View Calendars and View Calendar Events if you want appointments, and View Custom Fields. Leave every Edit scope unchecked.
   4. Create it and copy the token into your password manager immediately. HighLevel shows it once.
   5. Copy the sub-account's Location ID into the same password manager entry. You send it as the locationId header.

   Check: The integration appears in the Private Integrations list, and its scope list contains no Edit permissions.

3. 03

   HighLevel: call the MCP server from Grok with an allow-list

   Use the xAI Responses API with a Remote MCP tool. The allowed_tools list is your second lock: even if a token had write scopes, Grok only sees these eight read tools. Replace the placeholders and send the request from a tool like Postman, curl, or a small script. Keep the token out of any file you share.

   POST https://api.x.ai/v1/responses
   Authorization: Bearer $XAI_API_KEY
   Content-Type: application/json
   
   {
     "model": "grok-4.7",
     "input": [
       { "role": "system", "content": "<paste your CRM Manager instructions here>" },
       { "role": "user", "content": "Find contacts tagged buyer whose last activity is older than 30 days. Read only. Return Contact ID, name, stage, last activity and why they need attention." }
     ],
     "tools": [
       {
         "type": "mcp",
         "server_url": "https://services.leadconnectorhq.com/mcp/",
         "server_label": "highlevel",
         "server_description": "Read-only HighLevel sub-account for Coastal Key Realty",
         "allowed_tools": [
           "contacts_get-contacts",
           "contacts_get-contact",
           "contacts_get-all-tasks",
           "conversations_search-conversation",
           "conversations_get-messages",
           "opportunities_search-opportunity",
           "opportunities_get-pipelines",
           "locations_get-custom-fields"
         ],
         "headers": {
           "Authorization": "Bearer <PRIVATE_INTEGRATION_TOKEN>",
           "locationId": "<LOCATION_ID>"
         }
       }
     ]
   }

   Copy

   Check: The response lists real contacts from your sub-account, and the tool calls shown in the response use only tools from your allow-list.

4. 04

   Follow Up Boss: register your system and pull a CSV with GET only

   1. Get your API key from Admin → API in Follow Up Boss. Store it in your password manager.
   2. Register your system at Follow Up Boss's system registration page (linked from its Registration and Identification docs) to receive X-System and X-System-Key values. Follow Up Boss asks every API user to register, and requires it if you serve a Follow Up Boss customer. Unregistered requests get lower rate limits.
   3. Save the script below as fub-export.mjs on your computer. It needs Node.js 18 or newer.
   4. Run it with the three values as environment variables, as shown in its first comment. It writes a CSV to the file you name.
   5. Add the opt-out and consent columns from your account (see the callout), then upload the file to Grok as in chapter 02.05.

   // fub-export.mjs: read-only pull of Follow Up Boss people into a CSV.
   // Run: FUB_API_KEY=... FUB_SYSTEM=... FUB_SYSTEM_KEY=... node fub-export.mjs > crm-export.csv
   // Uses GET only. Never add POST, PUT or DELETE calls to this file.
   const key = process.env.FUB_API_KEY;
   if (!key) throw new Error("Set FUB_API_KEY");
   const headers = {
     Authorization: "Basic " + Buffer.from(key + ":").toString("base64"),
     "X-System": process.env.FUB_SYSTEM ?? "",
     "X-System-Key": process.env.FUB_SYSTEM_KEY ?? "",
     Accept: "application/json",
   };
   const fields = "id,firstName,lastName,emails,phones,source,stage,tags,assignedTo,created,lastActivity";
   const q = (v) => '"' + String(v ?? "").replace(/"/g, '""') + '"';
   const out = ["Contact ID,First Name,Last Name,Email,Phone,Source,Stage,Tags,Assigned To,Created,Last Activity"];
   const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
   
   for (let offset = 0; ; offset += 100) {
     const url = `https://api.followupboss.com/v1/people?limit=100&offset=${offset}&sort=lastActivity&fields=${fields}`;
     const res = await fetch(url, { method: "GET", headers });
     if (res.status === 429) { await sleep(1000 * Number(res.headers.get("Retry-After") ?? 10)); offset -= 100; continue; }
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
     const { people = [] } = await res.json();
     for (const p of people) {
       out.push([p.id, p.firstName, p.lastName, p.emails?.[0]?.value, p.phones?.[0]?.value, p.source, p.stage,
         (p.tags ?? []).join(";"), p.assignedTo, (p.created ?? "").slice(0, 10), (p.lastActivity ?? "").slice(0, 10)].map(q).join(","));
     }
     if (people.length < 100) break;
   }
   console.log(out.join("\n"));

   Copy

   Check: The CSV opens in a spreadsheet, its row count matches your People count (excluding Trash), and you have added the opt-out columns.

5. 05

   Store, rotate and revoke keys on a schedule

   • Keep tokens only in a password manager or environment variables. Never in a Grok chat, a shared document, a Bot you share, or a URL.
   • HighLevel recommends rotating PITs every 90 days. Rotate and expire this token later keeps the old and new tokens working for 7 days; Rotate and expire this token now is for a leak.
   • Editing a PIT's scopes does not create a new token. Delete the PIT from its three-dot menu when you stop using it.
   • For Follow Up Boss, a key leak means the user's full access leaked. Ask the account owner how to reset that user's key, and use the lowest-permission user that can see the contacts you need.

   Check: Your password manager entry has a "rotate by" date 90 days from today.

Copyable templates

Key name,System,Owner,Scopes or user level,Read-only how,Where stored,Created,Rotate by,Revoked
Grok CRM Manager (read-only),HighLevel PIT,Dana Reyes,View scopes only,Scopes + allowed_tools,Password manager,2026-10-20,2027-01-18,
fub-export,Follow Up Boss API key,Dana Reyes,Agent user,GET-only script,Password manager,2026-10-20,2027-01-18,
xAI API,xAI console,Dana Reyes,Team API key,n/a,Password manager,2026-10-20,2027-01-18,

Try it

How to test it

Prove it cannot write. On a test sub-account or test contact, ask through your HighLevel request: "Add the tag test-write to contact <ID>." The answer should say it has no tool for that, and the contact's tags should be unchanged in HighLevel. For Follow Up Boss, search your script for the words POST, PUT and DELETE: there should be no matches.

Troubleshooting

Advanced technical details

Optional. You can follow every step above without these.