GoHighLevel API
API v1 is end of life and no longer maintained. Everything runs on v2 now. It uses OAuth 2.0 and REST endpoints, and the public docs sit in the GoHighLevel/highlevel-api-docs repository on GitHub.
Private token or marketplace app
Private Integration Token. This is for internal tools living inside one sub-account. Generate it in the sub-account, drop it in as a bearer token, done. Most agencies need nothing more than that, and it takes minutes.
Marketplace App. This is the one for anything you hand out to other GoHighLevel accounts. Full OAuth 2.0 flow, scopes, install and uninstall handling, then a review process on top. If you are shipping a product, you need all of it. If you are wiring up one client, it is overkill.
What breaks
v1 keys are not an option any more. Anything built on them has to be rewritten against v2 endpoints with OAuth, and the endpoint shapes changed too, not just the auth, so budget for more than a token swap. Work from the GitHub repo, not an old blog post. The third-party guides are mostly still describing v1.
The honest question
Plenty of API projects here end up rebuilding something that already exists as an app or a Zapier connection. Review requests are the usual example. It looks like a small build right up until you hit delivery windows, follow-up timing, opt-outs and 10DLC compliance.
The review integration you were about to build
Trophy Jar already does it. Connect GoHighLevel, pick the trigger, and every matching contact gets a Google review request, with follow-up, opt-out handling and compliance included. With GoHighLevel we send from the number you already use in GHL, so your customer sees the same number they have been texting all along. Nothing lands in a second thread.