GoHighLevel n8n Advice for an Owner Whose Leads Arrive by DM

What to keep in GoHighLevel, what to hand to n8n and the three ways to connect them, told as a letter to a med spa owner whose DM booking bot cannot fail.

By Carlos Familia, CRM & AI automation expert. Updated October 14, 2026. 7 min.

If you run a med spa that gets most of its new leads through Instagram and Facebook DMs, this letter is for you. It applies to any business that sells appointments, but I wrote it with you in mind.

A med spa in New Jersey had a problem you may recognize. Ad leads sent DMs, replies were slow, and the stock GoHighLevel bot prompt kept sending booking links. I built a router in n8n that hands each message to a booking, support or info agent. Each agent has tools to check availability, book, reschedule, cancel and escalate.

One bug taught me the most. The bot told a client it had moved their appointment to Friday. It had made no tool call, and it had the weekday wrong, so the client showed up to no appointment. Now the tools return a weekday table, and a change counts only when the tool succeeds.

Here is what I would tell you before you pay anyone. Keep in GoHighLevel everything that is a simple rule about a contact: tags, stage moves, tasks, reminders and text or email sequences. Hand to n8n anything that needs another system's data, a loop, an AI model, retries or an alert when something stops. You connect the two in one of three ways, and I explain each below.

Which of your jobs belong in GoHighLevel?

Anything your staff should be able to open and read. If the rule is "when a lead fills the form, text them, create a task and move the stage", keep it where your team can see it.

When n8n does something, leave a marker in GoHighLevel: a tag or a note. Your front desk will never open n8n, and they should not have to.

The med spa build shows the split. A reactivation tagger in n8n decides who is due for a nudge at 15 minutes, 24 hours, 2 days and 7 days. It skips anyone who refused and respects business hours. Then it tags the lead, and the tag is what your staff sees.

Which jobs should you hand to n8n?

If you are choosing a builder for the n8n side, my guide to hiring an n8n developer has the checklist. For the GoHighLevel side, see how to hire a GoHighLevel expert.

How will the two tools talk to each other?

You have three options. Ask your builder which one they will use, and why.

A webhook step inside a GoHighLevel workflow

The Custom Webhook action sends the contact to n8n. Know three things before you rely on it.

• It is a premium action. HighLevel's premium features article lists custom webhooks as an example and sets the standard price at $0.01 per execution.
• If the agency wallet runs dry, the step is skipped without an alert. You only see why by opening that step in the execution log.
• In n8n, your custom data arrives nested under a "customData" key inside the request body, not at the top level.

One more lesson came from a mortgage brokerage in Florida. I converted marketplace action nodes to webhooks, and a hidden flag stayed on them, so GoHighLevel skipped the steps. Leads that arrived in office hours got no welcome for about two days, five leads in all. After you change a node type, read a real run's log.

Marketplace app webhooks

For your DMs, I used an app webhook that pushes each new message to n8n. It replaced a poll that ran every 30 seconds. The poll had one conversation hardcoded, so deleting a test contact silenced the bot. Overlapping polls also double-replied, which I fixed with a table that lets each message be claimed once.

Two platform rules matter here. A draft marketplace app fires no webhooks, and no app installs without a client key. Ask your builder whether the app is published or still a draft.

The router also keeps a tester whitelist, so test messages never reach real clients, and a guard that blocks a second reply to the same message. Those two guards are boring, and they are the reason you can switch the bot on at all.

A private integration token

This is how my n8n jobs read and write in GoHighLevel. HighLevel's Private Integrations docs describe a static token with scopes you choose. It is shown once, it goes in the Authorization header like any access token, and HighLevel recommends rotating it every 90 days.

The scopes are where it bites. My daily call queue for the Florida brokerage runs in n8n, and the main token lacked the users scope the job needed. Ask your builder which scopes each token has, and why.

n8n's built-in HighLevel credentials work differently. The n8n docs say to use OAuth2 for the current API, with an app you create under My Apps, and the old API key is deprecated.

HighLevel also limits traffic: a burst of 100 requests per 10 seconds and 200,000 a day, counted per app per resource. On that same call queue, rate-limit errors swallowed 28 contact reads and 16 tags on the first live run, and nothing flagged it. Retries with backoff fixed it.

What will break first in your build?

Here is what broke in builds like yours.

• A tag trigger will miss leads. At a med spa in Pennsylvania, I checked each link of the chain against live data before building. 42 of 45 recent Facebook contacts had no tags at creation, and the marketplace feed had been dead for weeks, leaving about 45 form leads unanswered. So I built a poller that checks about every 20 seconds for new contacts by form ID.
• A tag is an event, not a state. Switching a tag on calls nobody who already has it.
• A silent filter will drop data. In the Florida brokerage's old Zapier setup, filters threw away 9 records in a week and logged each one as a success. In n8n, a reconciler now runs every 5 minutes and sends an alert when no loan system ID lands within 15 minutes.
• A limit you assumed will be wrong. A daily message cap was set to 200 on the belief that a provider's limit was 210. The real limit was 10 a day, and failures arrived 5 to 6 minutes after sending, so a 30-second check missed them.
• The first run will tag the wrong people. The med spa tagger tagged 94 leads on its first run, and 8 were wrong, so I cleaned them. The second run tagged 1 lead with no leaks.
• A story reply can be a real lead. The app webhook for incoming messages has no attachments field. Of 7 Instagram story replies I checked, 2 were real leads. Filter on intent, not on message type.
• A failed text will look like a refusal. When a text failed with a carrier error, GoHighLevel turned on SMS do-not-disturb, and the bot read that as STOP.

I go deeper on bot failures in n8n AI agent lessons from production, and the same patterns appear in my med spa CRM notes.

Who should you hire to build it?

Hire one person who can do both halves, or two people with a clear boundary. A GoHighLevel builder who has never run n8n will push logic into workflows that cannot hold it. An n8n developer who has never run GoHighLevel will miss the platform traps that fail silently.

If the build needs custom code beyond n8n, such as a marketplace app, read about the GoHighLevel developer role. For n8n costs, see what an n8n developer costs.

Ask three questions.

• Where does n8n run, and who owns the server?
• Is the error workflow published? An unpublished error workflow never runs.
• Can I see the log of a failed run, and how you found it?

I also test every path before a bot touches a real lead. My method is in how I test GoHighLevel workflows.

P.S. Before you pay anyone, ask which of the three connections they plan to use. If the answer is "whatever works", keep looking. The calendar below is open if you want a second opinion on a plan.

About the author

Carlos Familia, CRM & AI automation expert. GoHighLevel, n8n, AI agents, servers. Full-stack developer.

I build CRM systems in GoHighLevel, n8n automations on my own servers and AI voice and chat agents for service businesses. Full-stack developer: I write the workflow, the API integration, the database and the server it runs on, and I test every build with real journeys before handoff.