Asana is a work-management platform for projects, tasks, and team coordination. Use OAuth for user-delegated MCP access, or use a personal access token only for a dedicated non-interactive identity.
This guide prepares Asana for any compatible MCP client. The Asana agent template is separate: it deploys the Dome workspace, agent, model, tools, and rules after the Asana authorization is ready.
Choose a connection method
Choose OAuth when the MCP connection should use an individual member's normal Asana access. Choose a personal access token only for a named, non-interactive automation identity. Asana documents both OAuth and personal access tokens.
Recommended: OAuth as a dedicated Asana member
Use OAuth when the MCP server should act with a person's normal Asana access. Create a test member and a test project first; do not begin with an administrator account or a production-wide personal access token.
- Open Asana's Developer Console and create an OAuth app for the MCP client.
- Set the app name, owner, and the exact redirect URL requested by the client. For Dome, use
https://api.domesystems.ai/oauth/callback. - Copy the client ID and client secret to secret storage. Never add them to the MCP prompt or repository.
- Start OAuth from the MCP client and sign in as the test member. Select only the intended Asana workspace.
- Confirm the member can open one known task and cannot reach a project outside the test workspace.
Asana's OAuth guide is the authority for redirect requirements and current scopes.
Alternative: Personal access token
Use an Asana personal access token only where the MCP client cannot complete OAuth. Create it under the intended test identity, record an owner and rotation date, and revoke it when that automation ends. A PAT inherits every permission of its owner.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Asana MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Asana MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Asana boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
An OAuth redirect mismatch means the URL in the Asana app does not exactly match the client callback. If content is missing after consent, check the selected workspace and the test member's project membership before changing credentials.
Next steps
Deploy the Asana agent template to create a governed agent in Dome that can work with the approved projects and tasks, with the template's included model, tools, and rules.
