> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automate.ax/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Automate.ax automations are TypeScript programs.
> Use Bun for installation and command examples.
> Use Automate.ax for the product name and automate.ax for the package, CLI, and domain.
> Treat documented public APIs as current; do not invent transitional or deprecated names.

# Authorization and webhooks

> Connect ClickUp with OAuth or a personal token and understand Workspace access, rate limits, pagination, and signed webhooks.

## Connect ClickUp

Choose OAuth for shared projects. ClickUp asks you to select the Workspaces the Automate.ax app may access. ClickUp currently issues non-expiring OAuth access tokens and does not publish granular OAuth scopes or a refresh-token flow.

Use a personal API token for development or a connection owned by one ClickUp user. Create it in ClickUp under **Settings → Apps**, then paste the complete `pk_...` token into Automate.ax. Automate.ax sends personal tokens directly and OAuth access tokens with ClickUp's required `Bearer` prefix. Both methods act with the connected user's ClickUp permissions.

```ts theme={null}
import { automation, onDashboardRun } from "automate.ax"
import { clickUp, clickUpAccount } from "automate.ax/clickup"

const operations = clickUpAccount("operations")

export default automation("List ClickUp spaces", () => {
  onDashboardRun({ title: "List ClickUp spaces" })
  clickUp.listSpaces({ account: operations, workspaceId: "workspace-id" })
})
```

## Workspace IDs and hierarchy

ClickUp's API still calls a Workspace a `team` in request paths and some responses. Automate.ax consistently exposes `workspaceId`. Use `clickUp.listWorkspaces()` to find authorized IDs, then traverse Spaces, Folders, and Lists.

## Pagination and timestamps

Task pages are zero-based and contain at most 100 tasks. Pass the next numeric `page` until ClickUp reports `lastPage`. Task comments use a paired cursor: pass both `start` and `startId` from `pageInfo`; passing only one is rejected. ClickUp date and duration fields use Unix milliseconds represented as numbers or digit strings unless an action states otherwise.

## Rate limits

ClickUp limits requests per access token and Workspace plan. Current published limits are 100 requests per minute for Free Forever, Unlimited, and Business; 1,000 for Business Plus; and 10,000 for Enterprise. A rejected request exposes the provider status and `rateLimitReset` Unix timestamp through `ClickUpApiError`.

## Signed Workspace webhooks

Every ClickUp trigger requires a `workspaceId`. Automate.ax combines triggers for the same connected user and Workspace into one provider webhook, updates the provider event set when deployments change, and deletes the webhook after the last subscription is removed.

ClickUp returns a unique signing secret for each webhook. Automate.ax encrypts it and verifies `X-Signature` as a hexadecimal HMAC-SHA256 over the exact request body before parsing or ingesting an event. Provider retries deduplicate by `webhookId` and history-item ID; payloads without a history item use a stable body digest.

Webhooks belong to the ClickUp user who created them. Replacing the connected account can therefore replace the provider webhook. ClickUp may disable a webhook after repeated delivery failures; reconciliation verifies the remote endpoint, Workspace, and subscribed events before retaining persisted state.