Authentication

Every Taskade developer surface uses a Bearer token. These surfaces include REST API v1, Action API v2, and the MCP servers.

When you act as yourself, use a Personal Access Token. When another user grants access, use OAuth 2.0.

Choose a credential

Personal Access Tokens

Personal Access Tokens authenticate requests as yourself. They work well for server scripts, the inbound MCP server, and initial development.

Create a token

1. Go to taskade.com/settings/api.
2. Click Create token.
3. Give the token a descriptive name.
4. Copy the token immediately. Taskade shows it only once.

A personal access token starts with the prefix tskdp_. You can hold up to 5 tokens per account, and your email must be verified to create one.

A personal access token grants full access to your account. Treat it like a password.

Never commit or share the token. Store it in an environment variable or secret manager.

Use a token

Send it in the Authorization header on every request:

# REST API v1
curl -H "Authorization: Bearer tskdp_your_token" \
     https://www.taskade.com/api/v1/me/projects

# Action API v2
curl -X POST https://www.taskade.com/api/v2/listMyProjects \
     -H "Authorization: Bearer tskdp_your_token" \
     -H "Content-Type: application/json" -d '{}'

The inbound MCP server reads it from the TASKADE_API_KEY environment variable. See Workspace MCP.

Use a personal token with hosted MCP

The hosted endpoint at https://www.taskade.com/mcp accepts the same tskdp_… Personal Access Token as the public APIs:

POST https://www.taskade.com/mcp
Authorization: Bearer tskdp_your_token
Content-Type: application/json

Choose this option for a script, server process, CI job, or MCP client where you control the request headers.

The connection acts as your Taskade account. Personal tokens carry no OAuth scopes and grant their owner's access. Do not distribute them.

For Claude, Cursor, and other interactive clients with remote MCP OAuth support, prefer the OAuth flow. The flow keeps a full-account personal token out of the client. It also gives each user a separate consent flow.

OAuth 2.0

Use OAuth 2.0 when your application acts on behalf of other users. Each user signs in and grants access.

Also use OAuth 2.0 for interactive clients that connect to hosted MCP. Header-controlled scripts can use a Personal Access Token instead.

Endpoints

Register an application

Go to taskade.com/settings/api → OAuth 2.0 Apps. Register your app and set its redirect URI(s).

Taskade gives you a Client ID and Client Secret.

Authorization Code flow (with PKCE)

Taskade supports the Authorization Code grant with PKCE (S256), the recommended flow for both confidential and public clients.

1. Redirect the user to /oauth2/authorize with client_id, redirect_uri, response_type=code, code_challenge, and code_challenge_method=S256. When your app needs specific permissions, add scope.
2. Exchange the returned code at /oauth2/token with grant_type=authorization_code and your code_verifier.
   • For confidential apps, also send client_secret.
   • For public clients, omit client_secret.
3. Store the access_token and refresh_token. The access token is valid for 1 hour.

Generating the PKCE pair (the step most implementations get wrong):

# code_verifier: a high-entropy random string
code_verifier=$(openssl rand -base64 96 | tr -d '\n=+/' | cut -c1-64)

# code_challenge = BASE64URL( SHA256(code_verifier) )
code_challenge=$(printf '%s' "$code_verifier" \
  | openssl dgst -binary -sha256 \
  | openssl base64 | tr -d '=\n' | tr '+/' '-_')

Send code_challenge (with code_challenge_method=S256) on the authorize request. Then send the original code_verifier on the token exchange that follows.

curl -X POST https://www.taskade.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "code_verifier=PKCE_VERIFIER" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "redirect_uri=YOUR_REDIRECT_URI"

Refresh an expired token

Access tokens expire after one hour. Exchange the stored refresh token for a new one:

curl -X POST https://www.taskade.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=YOUR_REFRESH_TOKEN" \
  -d "client_id=YOUR_CLIENT_ID"

Taskade supports the authorization_code and refresh_token grants only. Taskade rejects password, implicit, and client_credentials.

Scopes & the hosted MCP

When you use OAuth, the hosted MCP server at https://www.taskade.com/mcp requires an access token with the mcp scope. When you add the server URL, MCP clients (Claude Desktop, Cursor, Claude Code) do this handshake automatically, with dynamic client registration. Personal Access Tokens do not use OAuth scopes. If you set the Authorization header yourself, as shown earlier, use a personal token.

Security Best Practices

• Never expose tokens in client-side code. Personal tokens grant full account access.
• Use OAuth, not personal tokens, for an app that more than one person uses.
• Store refresh tokens encrypted at rest. They are long-lived.
• Rotate personal tokens periodically. You can keep up to 5 active.
• Always use HTTPS.

Related

→ Personal Access Tokens

→ Action API Guide