From 3d1e80cd8667ebac0d51d20dc9b19a2c377b1680 Mon Sep 17 00:00:00 2001
From: Head of Product & Engineering <cast-hpe@cast.ph>
Date: Mon, 6 Apr 2026 10:17:45 +0200
Subject: [PATCH] fix: add locations.readonly scope to OAuth install request

The /locations/search endpoint requires locations.readonly scope.
Without it the company token gets 401 when trying to list locations
during bulk install, blocking the per-location token exchange.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 internal/ghl/oauth.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/internal/ghl/oauth.go b/internal/ghl/oauth.go
index 99e21e3..be636f5 100644
--- a/internal/ghl/oauth.go
+++ b/internal/ghl/oauth.go
@@ -62,6 +62,7 @@ func (h *OAuthHandler) HandleInstall(w http.ResponseWriter, r *http.Request) {
 		"conversations.readonly",
 		"contacts.readonly",
 		"contacts.write",
+		"locations.readonly",
 	}, " ")
 
 	authURL := fmt.Sprintf(