Clickup Authentication

generated: '2026-09-17'
method: searched
docs: https://developer.clickup.com/docs/authentication
source: >-
  https://developer.clickup.com/docs/authentication (docs) upgraded over the derived read of
  openapi/clickup-api-v2-reference-openapi.json and openapi/clickup-public-api-v3-openapi.json
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  api_key_names: [Authorization]
  oauth2_flows: [authorizationCode]
  token_expiry: none
  note: >-
    ClickUp carries BOTH credentials in the same `Authorization` header, which is why both specs declare
    only an apiKey scheme: a personal token is sent bare (`Authorization: pk_...`) and an OAuth access
    token is sent as `Authorization: Bearer {access_token}`. The OAuth flow is documented in prose and by
    the GetAccessToken operation, not by an oauth2 securityScheme.
schemes:
- name: Authorization_Token
  type: apiKey
  in: header
  parameter: Authorization
  description: >-
    Personal API token (prefix `pk_`, generated in Settings > Apps, never expires) or an OAuth 2.0 access
    token sent as a Bearer value.
  sources: [openapi/clickup-api-v2-reference-openapi.json]
- name: authHeader
  type: apiKey
  in: header
  parameter: Authorization
  sources: [openapi/clickup-public-api-v3-openapi.json]
- name: ClickUp OAuth 2.0
  type: oauth2
  flow: authorizationCode
  authorization_url: https://app.clickup.com/api
  token_url: https://api.clickup.com/api/v2/oauth/token
  token_operation: GetAccessToken
  scopes: []
  authorization_unit: workspace
  expires: false
  docs: https://developer.clickup.com/docs/authentication
  note: >-
    Users authorize specific Workspaces rather than scopes. Access tokens do not expire (developer FAQ).
    Client credentials are issued when an app is created by a Workspace owner or admin.
- name: ClickUp MCP OAuth 2.0
  type: oauth2
  flow: authorizationCode
  authorization_url: https://mcp.clickup.com/oauth/authorize
  token_url: https://mcp.clickup.com/oauth/token
  registration_url: https://mcp.clickup.com/oauth/register
  pkce: S256
  scopes: [read, write]
  resource: https://mcp.clickup.com
  sources: [well-known/clickup-mcp-oauth-authorization-server.json, well-known/clickup-mcp-oauth-protected-resource.json]
  note: Separate authorization server from the public API; dynamic client registration is open (token_endpoint_auth_methods_supported ["none"]).
webhook_authentication:
  mechanism: HMAC-SHA256
  header: X-Signature
  secret: per-webhook shared secret returned when the webhook is created
  docs: https://developer.clickup.com/docs/webhooksignature