usertasks
All documentationStart free beta
Documentation hub

Feature guide

API, OAuth, and MCP

Operate UserTasks programmatically with scoped credentials and standards-based authorization.

Open public API Explorer
On this page

Complete feature description

Understanding api, oauth, and mcp in UserTasks

The UserTasks developer surface includes versioned REST endpoints, tenant and user-context API keys, an OAuth 2.0 authorization server, and an MCP server for compatible AI clients. These interfaces expose the same governed assets and permissions used by the product UI.

API keys are show-once secrets with permission ceilings, expiration, revocation, and optional resource restrictions. OAuth applications can be public or confidential and use discovery metadata, PKCE authorization code, client credentials, refresh-token rotation, and revocation.

The MCP endpoint exposes a catalog of platform tools over streamable HTTP. OAuth or API-key authentication is resolved into tenant context and permissions before any tool or REST action executes.

When to use this feature

  • Another application must create, query, or action UserTasks assets.
  • A partner integration needs delegated user authorization.
  • A background service needs tenant-bound machine access.
  • An AI client should discover and invoke approved UserTasks capabilities.

What you can build

  • Custom customer or partner portals
  • Background workflow launchers
  • External task inboxes
  • OAuth-connected applications
  • AI operations clients over MCP
  • Reporting and data-export integrations

Production design notes

  • Use OAuth for delegated third-party access and scoped keys for controlled service integrations.
  • Store secrets outside source code and rotate or revoke them when ownership changes.
  • Request only required scopes and handle 401, 403, 429, and retryable server responses.
  • Use idempotency patterns around create/start operations when clients may retry.

Core concepts

REST API

Versioned endpoints expose tasks, workflows, forms, reports, documents, agents, retention, and other assets.

API keys

Tenant or user-context keys have permission ceilings, expiration, revocation, and optional resource allowlists.

OAuth provider

Registered apps use discovery, PKCE authorization code, client credentials, refresh rotation, and token revocation.

MCP server

Compatible AI clients discover and invoke governed UserTasks tools over streamable HTTP.

Actions and capabilities

What designers and operators can do in this product area.

API, OAuth, and MCP actions

The main operations available in API, OAuth, and MCP.

API, OAuth, and MCP actions

Create API key

Choose tenant or user context, permissions, resource scopes, and expiration.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Create API key”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

API, OAuth, and MCP actions

Register OAuth app

Choose public or confidential type, redirect URIs, grants, and allowed scopes.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Register OAuth app”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

API, OAuth, and MCP actions

Authorize with PKCE

Request user-delegated access through consent and exchange a single-use code.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Authorize with PKCE”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

API, OAuth, and MCP actions

Use client credentials

Issue tenant-bound machine access for confidential clients.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Use client credentials”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

API, OAuth, and MCP actions

Refresh or revoke

Rotate refresh tokens and revoke tokens or entire client applications.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Refresh or revoke”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

API, OAuth, and MCP actions

Connect MCP client

Use authorization metadata and the MCP endpoint to expose approved tools.

Example: Authorize a partner portal with PKCE to create and monitor tasks for the signed-in user.
Configuration inputs
  • Permission to view and edit the relevant api, oauth, and mcp assets.
  • The target credential, client registration, scopes, grants, redirect URIs, and resource limits.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open API Keys or OAuth Apps from the main navigation.
  2. 2.Create or open the relevant asset and choose “Connect MCP client”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The client receives only the authorized programmatic access and every call remains attributable.
  • Failures remain visible with enough context to correct configuration or retry safely.

Potential use cases

Patterns you can adapt to your own operating model.

Custom portal

Create and action UserTasks work from a separate customer or partner application.

Register OAuth app
User consent
Call REST API
Refresh access
Revoke on disconnect

AI operations client

Let an approved AI client author or operate tenant assets through MCP.

Discover OAuth metadata
Authorize user
Connect MCP
Invoke scoped tools
Audit calls