The Own Login Rule: how to connect an AI agent to your CRM so it keeps working, for HubSpot and GoHighLevel

When an AI agent inside a CRM stops working overnight, the cause is usually boring: its login broke. A token expired, the person who set it up left, or the agent was sharing someone's password. The Own Login Rule prevents all three, and the checklists below cover the two CRMs we see most in home-service companies.

The Own Login Rule, in order

1. Its own app. The agent connects through its own app with only the scopes its job needs, like reading contacts and writing notes. Never a person's password.
2. Made by an account that stays. The app is created by an admin account that won't be offboarded when someone leaves.
3. A rotation date. A calendar reminder for every token that has to be rotated or renewed, with an owner.

Why logins are the weak spot

Agents fail quietly. A missed renewal doesn't throw an alarm in your office. Follow-ups just stop, and leads sit. That costs more than it looks: a Harvard Business Review study of online leads found that most companies were not responding to online sales leads nearly fast enough, and an agent that died on Tuesday night makes that worse without anyone noticing.

The two big CRMs handle access differently, so the details matter.

Who this is for and what you need first

This is for an owner or office manager connecting an AI agent (one you build or one a partner builds) to HubSpot or GoHighLevel. You need:

• Admin access in the CRM. In HubSpot, only super admins can create private apps. In GoHighLevel, a location or agency admin installs marketplace apps.
• A list of what the agent's job needs to read and write. Start narrow.
• A shared admin account owned by the company, like ops@yourcompany, rather than one person's login.

Step one, give the agent its own app

In HubSpot. Create a private app for the agent. HubSpot's docs say private apps are created by super admins, each app gets its own access token sent as a Bearer header, scopes are chosen per app, and an account can have up to 20 private apps. Name the app after the job ("Cortex lead follow-up"), not after a person.

Pick scopes for the job, not for convenience. For a lead follow-up agent that's usually reading contacts and deals and writing notes or tasks. It doesn't need billing, users or the ability to delete records.

In GoHighLevel. Agents connect as a marketplace app that a location or agency admin installs. GoHighLevel's OAuth FAQ says the access token lasts one day and the refresh token expires after a year of non-use. So the build must refresh its token every day. A build that doesn't will work in testing and go quiet by the next morning.

Step two, have it made by an account that stays

People leave. When they do, their account gets removed, and anything tied to it can break.

HubSpot warns that removing the user who created a private app can cause its calls to fail with a USER_DOES_NOT_HAVE_PERMISSIONS error. So:

1. Create the app from a company-owned super admin account, not the office manager's personal login.
2. Write down who has access to that account and where its recovery details live.
3. Add "check CRM app owners" to your offboarding list, so nobody's removal surprises the agent.

In GoHighLevel, note which admin installed the app and keep that admin account active. If the install has to be redone, the agent's access comes back only after an admin authorizes it again.

Step three, put the rotation date on a calendar

Tokens don't last forever, and the reminders shouldn't live in someone's head.

• HubSpot: HubSpot recommends you rotate a private app's access token every six months. Put a recurring reminder on the shared calendar, with the name of who rotates it and who updates the agent's settings.
• GoHighLevel: the daily refresh should be automatic, so the reminder is a weekly check that the agent's last successful refresh was today. If the agent sits unused for months, remember the refresh token's one-year limit.

The setup checklist

HubSpot private app - [ ] Created by a company-owned super admin account - [ ] Named for the job, not a person - [ ] Scopes limited to what the job reads and writes - [ ] Token stored in the agent's settings, not in an email or a doc - [ ] Rotation reminder every six months, with an owner - [ ] Offboarding list includes "check CRM app owners"

GoHighLevel marketplace app - [ ] Installed by a location or agency admin whose account will stay - [ ] Scopes limited to what the job needs - [ ] Daily token refresh built in and tested past 24 hours - [ ] Weekly check that the last refresh succeeded - [ ] Rate limits respected (see below)

Both - [ ] The agent drafts; a named person approves anything a customer receives - [ ] Someone gets an alert when the agent's calls fail

Rate limits, so a careful build slows down

A well-built agent backs off before it hits a limit. HubSpot's usage details list limits per private app by tier: 100 requests per 10 seconds on Free and Starter, 190 on Professional and Enterprise, with daily caps of 250,000, 625,000 and 1,000,000. GoHighLevel's FAQ lists a burst limit of 100 requests per 10 seconds and a daily limit of 200,000 per app and per location or company. Exceeding them returns errors, so the agent should queue and retry.

What to watch out for

• Shared passwords. An agent that logs in as a person breaks the day the password changes, and it can do anything that person can. Always use an app.
• Too many scopes. It's tempting to grant everything to save time during setup. Narrow scopes are what keep a mistake small.
• Silent failures. Make sure a failed call reaches a human. A dead agent should be loud.

How to tell it worked

A month after setup, check three things: the agent's last successful run was today, the app owner account is still active, and the next rotation date is on the calendar with a name next to it. If all three are true, the login won't be the reason your agent stops.

More on the agent itself in an AI agent that uses my CRM, and how fast a lead should get a reply in speed to lead. Few small firms have done this yet; the Census Bureau found under 20% of firms with four or fewer employees were using AI as of May 2026. If you want it set up with you, your free AI Operations Audit covers your CRM.