Does ClickUp Have an API? Tokens, Webhooks and Rate Limits Explained for Gulf IT Teams

Quick answer

Yes. ClickUp has a public API, which ClickUp says is available on every plan. You authenticate with a personal token or an OAuth app, read and write tasks, Lists, comments, Custom Fields and time entries, and receive signed webhooks when work changes. Request limits and a few admin endpoints vary by plan.

The IT manager at a family group we work with in Doha sent us a vendor questionnaire last spring. Line 14 read: "API available? Yes/No." We wrote yes. Then we rang him, because yes is the least useful answer to that question. What he needed to know was whether purchase requests approved in his ERP could become tasks without anyone retyping them, and who would own that connection when it broke on a Thursday night.

So this article answers the question the way your IT team will ask it. What can the API reach? Whose access does an integration use? What happens when you send too many requests? Everything here comes from ClickUp's developer documentation as it reads today. Where the docs put a number on a limit, we've left it out on purpose, because limits change and plans differ.

The short answer

Yes. ClickUp has a public API and says it's available on every plan. It speaks JSON over HTTPS, and every request carries a token in the Authorization header: a personal one, or one issued through an OAuth app. With it you can create and update tasks, move them between Lists, set Custom Fields, post comments, log time and read all of it back.

Two limits up front. Request volume is capped per token, and the cap depends on the Workspace's plan. And a short list of endpoints, mostly user and guest administration, isn't open to every plan. If your integration has to invite or remove people, check that list first.

Four ways to connect, and which one you need

Before anyone writes code, ask whether you need code. There are four doors into ClickUp, and the API is only one of them.

Native integrations and no-code tools such as Make cover the common pairings; ClickUp's own help centre points to them. Automation webhooks let a ClickUp Automation call an outside URL when your Triggers and Conditions are met, so the logic stays where your admins can see it. The public API, with its own webhooks, is for cases that need full control. And ClickUp now runs an MCP server for AI assistants; it signs in with OAuth only and, for now, has no delete tools.

Our rule: take the first door that does the job. Custom code is the most flexible option. It's also the one somebody has to maintain for years.

What the API covers, and what trips people up

The reference is split in two. Version 2 holds the core of the Workspace: Spaces, Folders, Lists, tasks, comments, Custom Fields, Goals, views, templates, time tracking and webhooks. Version 3 adds Docs, Chat, attachments and audit logs. You'll use both in one integration, and that's normal.

A few details save your developers a day each:

• In version 2, the word team means Workspace, and a team_id is your Workspace ID. Everybody trips on this once.
• Task lists come back a page at a time, 100 tasks per page. A nightly export of forty thousand tasks is hundreds of calls, so plan for it.
• Custom Fields are set by the field's ID, not its name. Rename a field in the app and nothing breaks; delete and recreate it and everything does.

Tokens: whose access is your integration using?

This is the section we'd ask you to read twice. A personal token starts with pk_, anyone with an account can generate one, and ClickUp's docs say it never expires. It carries exactly the access its owner has in the browser, across every Workspace that person belongs to. ClickUp describes it as being for personal use and testing.

An OAuth app is the route for anything other people rely on. A Workspace owner or admin registers the app, each user signs in and chooses which Workspaces to authorise, and each gets an individual token limited to what that user can see. The docs say these access tokens don't currently expire either, and that this may change.

At a contracting group in Abu Dhabi, the link between the ERP and ClickUp ran for eight months on a project engineer's personal token. He resigned. HR closed his account on his last day, as they should, and on Monday morning approved purchase requests stopped arriving as tasks. Nobody had an alert. It took the procurement team three days to notice the List had gone quiet.

So here's what we recommend. Give every integration its own ClickUp user with a named human owner, limited to the Spaces it needs, and keep its token in your secrets vault. Yes, that's one more seat. It's cheaper than the alternative. And because tokens don't expire on their own, put rotation in your calendar; nobody else will.

Rate limits: plan for the ceiling

ClickUp limits requests per token, per minute, and the ceiling depends on the plan of the Workspace hosting the token. The gap between the lowest and highest tiers is wide, so don't size an integration from a blog post, ours included. Look up the current figure for your plan in ClickUp's developer docs.

When you go over, the API answers with HTTP 429, and the response headers tell you your limit, what's left and when the window resets. A well-built integration reads those headers and waits. A badly built one retries at once and makes things worse.

Webhooks: let ClickUp call you

Polling asks ClickUp every few minutes whether anything changed. A webhook turns that around: you register a URL, choose the events and the location, and ClickUp sends a POST when a task is created, changes status, gets a new assignee or due date, or receives a comment. Lists, Folders, Spaces and Goals have their own events.

Four facts from the docs that your security and infrastructure people will want:

• No fixed IP addresses. ClickUp says webhook traffic doesn't come from dedicated IPs, so an IP allowlist won't work. Verify the signature instead: each request carries an X-Signature header, an HMAC of the body made with a secret unique to that webhook.
• Answer fast. A delivery that takes more than a few seconds or returns an error counts as failed. Acknowledge at once, queue the event and check for duplicates before you process it.
• Failures are quiet. ClickUp retries an event a few times and then drops it; after enough failures the webhook is suspended, and no notification is sent. Check webhook health on a schedule.
• A webhook belongs to the user whose token created it. If that user is disabled, the webhook stays in place and stops firing. It's the Abu Dhabi story again.

What Gulf teams actually connect

In our projects the same four connections come up again and again.

• ERP or finance system. An approved purchase request or a new project code creates a task or a List from a template, and logged time flows back for costing. The ERP stays the system of record for money.
• Salesforce. A closed deal opens the delivery project with the account name and contract value already in Custom Fields. Our Salesforce integration patterns article and our tools comparison cover when a connector is enough and when you need the API.
• WhatsApp Business provider. Inbound customer messages reach ClickUp through your provider's webhook on one side and ClickUp's API on the other. Our WhatsApp article walks through the options.
• BI and reporting. Power BI or a data warehouse pulls tasks and time entries each night for the reports your board already reads. This is where rate limits and paging matter most.

A four-week plan for your first integration

You don't need a quarter for this. One integration, one List, four weeks.

Start with a test List of representative but harmless tasks, which is what ClickUp's own guidance suggests for a first webhook. Use a personal token in week one only, to explore, and move to the integration user before anything touches live data. Write down who owns the connection in Arabic and English; the person who gets the call at night may read one better than the other.

What we wouldn't do is sync everything in both directions. Pick one owner for each field. Two systems that can both edit the same due date will disagree by the end of the first week.

Three mistakes we see

They're rarely about code.

• Running production on someone's personal token. It works until that person leaves, and then it fails without telling anyone.
• Polling every minute, or pulling every task at 8 a.m., for changes a webhook would deliver. You burn the rate limit and still get the news late.
• No owner for the connection. An integration nobody owns is one nobody checks, and the first sign of trouble is a director asking why the report is empty.

How BuyClickUp helps

BuyClickUp is an independent ClickUp partner operated by Inspark, a Salesforce and ClickUp consultancy serving the UAE, Qatar and Kuwait from Dubai. We design and build ClickUp integrations with Salesforce, ERP and finance systems and messaging providers, and we start by asking whether you need custom code at all. We also work through the security questionnaire with your IT team, in English and Arabic. If you have a system that should be talking to ClickUp and isn't, contact us or take the free readiness assessment.

ClickUp is a trademark of Mango Technologies, Inc. BuyClickUp is not ClickUp. Salesforce, WhatsApp, Power BI and Make are trademarks of their respective owners. This article reflects our reading of ClickUp's developer and help documentation in November 2026. API availability, endpoints, rate limits, token behaviour, webhooks and the MCP server vary by plan and change over time; confirm current details with ClickUp before you build on them.