---
updatedAt: 2026-03-13T19:17:49.000Z
---

Fetch the complete documentation index at: https://developer.clickup.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Authentication

Authenticate to the ClickUp API using a personal token or OAuth.

# Authentication

To use the ClickUp API, you must authenticate every request.

For personal use, authenticate with your [personal API token](https://developer.clickup.com/docs/authentication#personal-token).

For apps or integrations that other people use, use the [OAuth flow](https://developer.clickup.com/docs/authentication#oauth-flow), allowing users to authorize Workspaces for your app.

Include the token in the **Authorization** header of your requests.

Both methods ensure that you and your users only have access to the information permitted by ClickUp.

> 👍 [View the OAuth endpoints.](https://developer.clickup.com/reference/getaccesstoken)

# Personal Token

Use a personal API token for individual or testing purposes. Personal tokens begin with `pk_`.\
Add the token to the header: `Authorization: {personal_token}`. This is also needed to use the Try-It feature in the API docs.

## Generate or regenerate a Personal API Token

1. Log in to ClickUp.
2. In the upper-right corner, click your avatar.
3. Select **Settings**.
4. In the sidebar, click **Apps**. Or click [here](https://app.clickup.com/settings/apps) to go directly to your settings.
5. Under **API Token**, click **Generate** or **Regenerate**.

   <Callout icon="👀" theme="default">
     ### Note

     You'll need to sign in to your ClickUp account in order to generate or regenerate a token.
   </Callout>
6. Click **Copy** to copy the personal token to your clipboard. Personal tokens never expire.

# Build Apps for others - OAuth Flow

To allow others to use your app, implement the OAuth2 flow so each user has their own token for accessing their ClickUp resources.

OAuth resources and specs:

* **Authentication:** OAuth 2.0
* **Grant Type:** `Authorization Code`. [Learn more](https://oauth.net/2/grant-types/authorization-code/).
* **Authorization URL:** `https://app.clickup.com/api`
* **Access Token URL:** `https://api.clickup.com/api/v2/oauth/token`

<Callout icon="👀" theme="default">
  ### Note

  ClickUp uses the [authorization code](https://oauth.net/2/grant-types/authorization-code/) `grant type`.  
  Use your personal API key to use the Try-It feature in the API docs.
</Callout>

## Step 1: Create an OAuth app

Only <Glossary>Workspace</Glossary> owners or admins can create OAuth apps.

1. Log in to ClickUp.
2. In the upper-right corner, click your avatar.
3. Select **Settings**.
4. In the sidebar, click **Apps**.
5. Click **Create new app**.
6. Name the app and add a [redirect URL](https://www.oauth.com/oauth2-servers/redirect-uris/).
7. You'll receive a `client_id` and `secret`.

## Step 2: Retrieve an Authorization Code

Send users to this URL to connect their ClickUp account:\
`https://app.clickup.com/api?client_id={client_id}&redirect_uri={redirect_uri}`

You can also add a `state` parameter:\
`https://app.clickup.com/api?client_id={client_id}&redirect_uri={redirect_uri}&state={state}`

<Callout icon="👀" theme="default">
  ### Note

  Non-SSL redirect URIs may not be supported in the future.
</Callout>

Users will be redirected back to the `redirect_uri` with the authorization code after logging in.

### Select Workspaces

![token\_teams](https://attachments3.clickup.com/49988c04-bf0f-42a5-96cc-82ce213b7f5e/token_teams.png)\
Users can authorize one or more Workspaces. Use the **[Get Authorized Teams (Workspaces)](https://developer.clickup.com/reference/getauthorizedteams)** endpoint to see which Workspaces are authorized. Redirect users to the authorization URL to modify Workspace permissions.

## Step 3: Request a Token

Use the [Get Access Token](https://developer.clickup.com/reference/getaccesstoken) endpoint with `client_id`, `client_secret`, and `code` to get the access token. This token is used in the `Authorization: Bearer {access_token}` header for all API requests made on behalf of the user.

The access token currently does not expire. This is subject to change.

**Learn more about OAuth:**

* [OAuth.net](https://oauth.net/)
* [OAuth Simplified](https://www.oauth.com/)
* [Digital Ocean Intro to OAuth 2.0](https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2)