clickup-security-basics

# ClickUp Security Basics ## Overview Secure ClickUp API credentials and access patterns. ClickUp personal tokens never expire, making rotation discipline critical. OAuth tokens also do not expire but can be revoked. ## Token Types and Risk | Token Type | Prefix | Expires | Scope | Risk Level | |------------|--------|---------|-------|------------| | Personal API Token | `pk_` | Never | Full user access | High -- treat like password | | OAuth Access Token | Varies | Never | Per-authorized workspace | Medium -- per-user | | OAuth Client Secret | N/A | Never | App-level | Critical -- server-side only | ## Secure Storage ```bash # .env (NEVER commit) CLICKUP_API_TOKEN=pk_12345678_ABCDEFGHIJKLMNOPQRSTUVWXYZ # .gitignore (mandatory) .env .env.local .env.*.local *.pem ``` ```bash # Git pre-commit hook to catch leaked tokens # .git/hooks/pre-commit #!/bin/bash if git diff --cached --diff-filter=ACM | grep -qE "pk_[a-zA-Z0-9_]{30,}"; then echo "ERROR: ClickUp API token detected in staged files!" echo "Remove the token and use environment variables instead." exit 1 fi ``` ## Token Rotation Procedure ```bash # 1. Generate new token: ClickUp > Settings > Apps > Regenerate # 2. Update environment export CLICKUP_API_TOKEN="pk_NEW_TOKEN_HERE" # 3. Verify new token works curl -sf https://api.clickup.com/api/v2/user \ -H "Authorization: $CLICKUP_API_TOKEN" | jq '.user.username' # 4. Update secrets in deployment platform gh secret set CLICKUP_API_TOKEN --body "$CLICKUP_API...