Connect ClickUp
Choose OAuth for shared projects. ClickUp asks you to select the Workspaces the Automate.ax app may access. ClickUp currently issues non-expiring OAuth access tokens and does not publish granular OAuth scopes or a refresh-token flow. Use a personal API token for development or a connection owned by one ClickUp user. Create it in ClickUp under Settings → Apps, then paste the completepk_... token into Automate.ax. Automate.ax sends personal tokens directly and OAuth access tokens with ClickUp’s required Bearer prefix. Both methods act with the connected user’s ClickUp permissions.
Workspace IDs and hierarchy
ClickUp’s API still calls a Workspace ateam in request paths and some responses. Automate.ax consistently exposes workspaceId. Use clickUp.listWorkspaces() to find authorized IDs, then traverse Spaces, Folders, and Lists.
Pagination and timestamps
Task pages are zero-based and contain at most 100 tasks. Pass the next numericpage until ClickUp reports lastPage. Task comments use a paired cursor: pass both start and startId from pageInfo; passing only one is rejected. ClickUp date and duration fields use Unix milliseconds represented as numbers or digit strings unless an action states otherwise.
Rate limits
ClickUp limits requests per access token and Workspace plan. Current published limits are 100 requests per minute for Free Forever, Unlimited, and Business; 1,000 for Business Plus; and 10,000 for Enterprise. A rejected request exposes the provider status andrateLimitReset Unix timestamp through ClickUpApiError.
Signed Workspace webhooks
Every ClickUp trigger requires aworkspaceId. Automate.ax combines triggers for the same connected user and Workspace into one provider webhook, updates the provider event set when deployments change, and deletes the webhook after the last subscription is removed.
ClickUp returns a unique signing secret for each webhook. Automate.ax encrypts it and verifies X-Signature as a hexadecimal HMAC-SHA256 over the exact request body before parsing or ingesting an event. Provider retries deduplicate by webhookId and history-item ID; payloads without a history item use a stable body digest.
Webhooks belong to the ClickUp user who created them. Replacing the connected account can therefore replace the provider webhook. ClickUp may disable a webhook after repeated delivery failures; reconciliation verifies the remote endpoint, Workspace, and subscribed events before retaining persisted state.