ClickUp API Tokens

Tokens de API pessoais do ClickUp permitem que seus workflows se autentiquem sem um fluxo de consentimento OAuth. Um token oferece paridade total com a API do ClickUp — tudo o que os blocos ClickUp do Zoen fazem via OAuth também funciona com um token.

Os tokens estão vinculados ao usuário que os cria: toda ação que um workflow executa é atribuída a esse usuário, e o token deixa de funcionar se o usuário for desativado ou removido do workspace. Para workflows de produção, crie o token a partir de um usuário de serviço dedicado (por exemplo, zoen-bot@yourcompany.com) em vez de uma conta pessoal.

Prerequisites

A ClickUp account with access to the workspaces your workflows need. Any user can generate a personal API token from their settings.

Creating the API Token

In the sidebar, go to Apps (labeled API Token in some plans)

Click Generate to create your personal token

Copy the token — it starts with pk_ — and store it somewhere safe.

The API token carries the creating user's full access to every workspace they belong to. Treat it like a password — do not commit it to source control or share it publicly. Zoen encrypts the token at rest.

Adding the API Token to Zoen

Open your workspace Settings and go to the Integrations tab

Search for "ClickUp Service Account" and click it, then click Add to Zoen and choose Add API token

Paste the API token (pk_...) and optionally set a display name and description

Click Add API token. Zoen verifies the token by fetching the authorized user from ClickUp — if it fails, you'll see a specific error explaining what went wrong.

The token is encrypted before being stored.

Using the Service Account in Workflows

Add a ClickUp block to your workflow. In the credential dropdown, your ClickUp service account appears alongside any OAuth credentials. Select it and configure the block as you normally would.

The block calls the ClickUp API (api.clickup.com) with the token. Everything the workflow does — creating tasks, adding comments, uploading attachments — is attributed to the user who created the token.

Common Questions

Not for API tokens — every token is tied to a user. The closest equivalent is creating a dedicated service user in your workspace and generating the token from that account, so workflows aren't attributed to (or broken by) a real person's account.

No — personal API tokens are long-lived and don't auto-rotate. They stay valid until regenerated, or until the user who created them is deactivated or removed from the workspace.

Tokens are user-bound, so deactivating the user kills the token and every workflow using it starts failing with authentication errors. This is exactly why production tokens should come from a dedicated service user.

Every workspace the creating user belongs to. Use the Get Workspaces operation to see what the token can access, and remember that removing the user from a workspace also removes the token's access to it.

Regenerate the token from the same service user in ClickUp (regenerating invalidates the old one immediately), then update the credential in Zoen with the new token.