ClickUp is a work-management platform for tasks, docs, and team operations. Use OAuth for user-delegated MCP access, or a personal API token only for a restricted automation identity.
This guide prepares ClickUp for any compatible MCP client. The ClickUp agent template is separate from the vendor-side OAuth setup.
Choose a connection method
Choose OAuth when access should follow a ClickUp member. Choose a personal API token only for a dedicated unattended identity. ClickUp documents both OAuth and personal-token authentication.
Recommended: OAuth
OAuth is the right path for a user-delegated ClickUp connection. Create a test workspace, a test Space/List, and a non-admin member with access only to that data.
- Create an OAuth application in the ClickUp developer portal.
- Register the client callback exactly as supplied by the MCP client. For Dome, enter
https://api.domesystems.ai/oauth/callback. - Keep the client secret in secret storage and start OAuth from the MCP client.
- Sign in as the dedicated test member and approve the intended workspace only.
- Read one known task and verify that a task in an unshared workspace is unavailable.
Alternative: Personal API token
Use a ClickUp personal token only for a non-interactive integration that cannot use OAuth. It has the permissions of its owner, so create it under the dedicated test member, not a workspace owner, and rotate it on a schedule. ClickUp's authentication documentation lists the current token behavior.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify ClickUp MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that ClickUp MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved ClickUp boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If consent succeeds but tasks are missing, check the member's workspace, Space, Folder, and List sharing rules. Do not solve a visibility problem by authorizing a workspace administrator.
Next steps
Deploy the ClickUp agent template to create a governed agent in Dome that can work with the approved workspace, Spaces, and Lists, with the template's included model, tools, and rules.
