monday.com

Overview

Connect your users to monday.com for work management, project boards, task tracking, and team collaboration.

Property	Value
Provider ID	monday
Category	Productivity
PKCE	Supported (S256 — required by monday.com’s OAuth 2.1 flow)
Token refresh	Automatic (1-hour access tokens; rotating refresh tokens)
Redirect URI	Shown in Developer Portal

Step 1: Create a monday.com OAuth App

Go to the monday.com Developer Center

Open the monday.com Developer Center by clicking the profile picture in the top-right of monday.com and selecting Developers.

Create a new app

Click Create app and enter the app name.

Enable the new OAuth flow

In Build > OAuth & Permissions, switch the New OAuth flow toggle on. Alter uses monday.com’s OAuth 2.1 flow, so token exchange fails while the toggle is off. The toggle is per app version — enable it on a draft version, then promote the draft to live.

Configure OAuth

Under OAuth, add the Alter callback URL from the Developer Portal to the Redirect URLs field.

Get credentials

Copy the Client ID and Client Secret from the app’s Basic Information section.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add monday.com provider

Go to OAuth Providers > Add Provider > monday.com.

Enter credentials

• Client ID: Paste your monday.com Client ID
• Client Secret: Paste your monday.com Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
me:read	Read your user information
boards:read	Read board data
boards:write	Create and update board data
workspaces:read	Read workspace data
updates:read	Read update posts
updates:write	Create and modify update posts

Additional scopes

Scope	Description
account:read	Read account-level information
ai:consume	Use monday AI features and consume AI credits
assets:read	Read files and assets stored on boards
departments:read	Read department information
departments:write	Create and modify departments
docs:read	Read monday docs
docs:write	Create and modify monday docs
notifications:write	Send notifications to users
tags:read	Read tags
teams:read	Read team information and membership
teams:write	Create and modify teams and their membership
users:read	Read user information
users:write	Create and modify users
webhooks:read	Read configured webhooks
webhooks:write	Create and delete webhooks
workspaces:write	Create and modify workspaces

Notes

• Alter uses monday.com’s OAuth 2.1 flow: the live app version must have the New OAuth flow toggle enabled, or every token exchange fails.
• Access tokens expire after 1 hour and are refreshed automatically; refresh tokens rotate on every refresh.
• monday.com sunsets legacy OAuth tokens on October 1, 2026 — connections made under the legacy flow keep working only until then.
• See the monday.com OAuth 2.1 migration guide for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
mutation/delete_item	admin, delete, read, send, write	POST	/v2