Todoist

Overview

Connect your users to Todoist for task management, project organization, and productivity tracking.

Property	Value
Provider ID	todoist
Category	Productivity
PKCE	Not supported
Token refresh	Automatic (new apps); legacy apps use permanent tokens
Redirect URI	Shown in Developer Portal

Step 1: Create a Todoist OAuth App

Go to the Todoist App Console

Navigate to Todoist Settings → Integrations → App Management and sign in.

Create a new app

Click Create a new app, enter the app name and description, and submit.

Configure the redirect URI

Add the Alter callback URL from the Developer Portal to the OAuth redirect URL field.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Todoist provider

Go to OAuth Providers > Add Provider > Todoist.

Enter credentials

• Client ID: Paste your Todoist Client ID
• Client Secret: Paste your Todoist Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
task:add	Create new tasks in Todoist
data:read	Read all Todoist data including tasks, projects, and labels
data:read_write	Read and modify all Todoist data — includes all read permissions, supersedes data:read
data:delete	Delete Todoist tasks, projects, and other data
project:delete	Delete Todoist projects

Additional scopes

Scope	Description
backups:read	Read Todoist data backups
billing:read	Read billing and subscription information
billing:read_write	Read and manage billing and subscription information
dev:app_console	Manage developer apps in the Todoist App Console
user:read	Read user account information
user:write	Modify user account settings
workspaces:read	Read workspace information and members
workspaces:write	Manage workspaces and their members

Notes

• Newly-created Todoist apps issue refresh tokens by default; access tokens expire after one hour and Alter Vault renews them automatically. Apps created before refresh tokens were introduced continue to receive long-lived tokens that do not expire.
• For most integrations, data:read or data:read_write is sufficient.
• See the Todoist authorization documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
create_task_api_v1_tasks_post	write	POST	/api/v1/tasks
get_task_api_v1_tasks__task_id__get	read	GET	/api/v1/tasks/{task_id}
get_tasks_api_v1_tasks_get	read	GET	/api/v1/tasks
get_tasks_by_filter_api_v1_tasks_filter_get	read	GET	/api/v1/tasks/filter
update_task_api_v1_tasks__task_id__post	write	POST	/api/v1/tasks/{task_id}
close_task_api_v1_tasks__task_id__close_post	write	POST	/api/v1/tasks/{task_id}/close
reopen_task_api_v1_tasks__task_id__reopen_post	write	POST	/api/v1/tasks/{task_id}/reopen
move_task_api_v1_tasks__task_id__move_post	write	POST	/api/v1/tasks/{task_id}/move
delete_task_api_v1_tasks__task_id__delete	delete	DELETE	/api/v1/tasks/{task_id}
create_project_api_v1_projects_post	write	POST	/api/v1/projects
get_project_api_v1_projects__project_id__get	read	GET	/api/v1/projects/{project_id}
get_projects_api_v1_projects_get	read	GET	/api/v1/projects
update_project_api_v1_projects__project_id__post	write	POST	/api/v1/projects/{project_id}
archive_project_api_v1_projects__project_id__archive_post	write	POST	/api/v1/projects/{project_id}/archive
delete_project_api_v1_projects__project_id__delete	delete	DELETE	/api/v1/projects/{project_id}
get_archived_api_v1_projects_archived_get	read	GET	/api/v1/projects/archived
permissions_api_v1_projects_permissions_get	read	GET	/api/v1/projects/permissions
get_project_collaborators_api_v1_projects__project_id__collaborators_get	read	GET	/api/v1/projects/{project_id}/collaborators
create_section_api_v1_sections_post	write	POST	/api/v1/sections
get_sections_api_v1_sections_get	read	GET	/api/v1/sections
delete_section_api_v1_sections__section_id__delete	delete	DELETE	/api/v1/sections/{section_id}
create_comment_api_v1_comments_post	write	POST	/api/v1/comments
get_comments_api_v1_comments_get	read	GET	/api/v1/comments
delete_comment_api_v1_comments__comment_id__delete	delete	DELETE	/api/v1/comments/{comment_id}
create_label_api_v1_labels_post	write	POST	/api/v1/labels
get_labels_api_v1_labels_get	read	GET	/api/v1/labels
delete_label_api_v1_labels__label_id__delete	delete	DELETE	/api/v1/labels/{label_id}