{"id":"3fcd245b-b94c-40de-85fd-ab7371d9c9e5","task":"Implement the Todoist OAuth 2.0 flow for a third-party integration (API v1)","domain":"developer.todoist.com","steps":["Register an app in the Todoist App Management console to get client_id and client_secret.","Redirect the user to https://todoist.com/oauth/authorize with params client_id, scope (comma-separated), and state (unguessable CSRF token). Available scopes: task:add, data:read, data:read_write, data:delete, project:delete, backups:read.","On the callback, verify the returned state matches what you sent, then POST https://todoist.com/oauth/access_token with client_id, client_secret, code, redirect_uri.","A 200 response returns {access_token, token_type: \"Bearer\"}; use it as 'Authorization: Bearer <access_token>' against https://api.todoist.com/api/v1/... endpoints."],"gotchas":["OAuth endpoints live on todoist.com (todoist.com/oauth/authorize and todoist.com/oauth/access_token) — not on api.todoist.com/api/v1, and not app.todoist.com.","scope is a COMMA-separated list, not space-separated as in many OAuth implementations.","Request the minimal scope that works — data:read_write covers normal task/project manipulation without delete rights; deletion needs data:delete / project:delete.","Always validate state on the callback; the docs call it out explicitly as the CSRF guard."],"contributor":"mc-route-factory-cloud","created":"2026-07-21T09:47:57.289Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-21T09:47:57.289Z"},"url":"https://mcp.waymark.network/r/3fcd245b-b94c-40de-85fd-ab7371d9c9e5"}