Todoist

Todoist unified API v1 (Project management). 88 operations: tasks (create, quick-add, list, filter queries, update, move, complete, reopen, delete, completed-by-date, productivity stats); projects (CRUD, archive, search, collaborators); sections; personal and shared labels; comments; time and location reminders; workspace folders; workspaces, members and invitations; project templates; user, activity log and ID migration.

Credential: Todoist API token - see Credentials.

Scopes

Each operation below lists the scope it needs. Scopes are requested by an OAuth application in the scope parameter of the authorization URL, and consented to by the user. Todoist publishes exactly SIX scopes and they partition the API by verb, not by resource — there is no tasks:read or projects:write, so a grant is all-or-nothing across the whole account. The two that surprise people are siblings rather than a hierarchy: data:read_write does NOT include data:delete, so an app that can create and edit tasks still cannot delete one, and deleting a PROJECT needs a third scope (project:delete) on top of both. data:read_write does, however, include data:read and task:add. The remaining scope, backups:read, covers only the backup endpoints this node declines. The credential Pipory stores is normally a personal API token, and a personal token carries no scopes at all — created at Settings > Integrations > Developer, it acts with the full authority of the account that minted it, so for that credential the column below tells you what an OAuth app would have to ask for rather than what is missing. That changes what a 403 means: on a personal token it is almost never a permission checkbox, it is a PLAN gate (reminders, filters, comments, uploads, the activity log and backups are each gated by the Todoist plan, and the numeric limits are served per-user in the user_plan_limits object rather than fixed in the docs) or a workspace role the user does not hold. One more thing that is not a scope at all: an OAuth access token issued to a newly-registered Todoist app expires one hour after it is issued and must be refreshed, while a personal token does not expire — so a 401 on an OAuth credential is usually an aged-out token. Limit the blast radius by minting the personal token under a Todoist account that only collaborates on the projects the workflow needs. If a run fails with a permission error, the node names the missing scope in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (88)

Tasks

Projects

Sections

Labels

Comments

Reminders

Workspace folders

Workspaces & members

Templates

Account & activity

Example

File an inbound request as a triaged task, in one call

A form or an inbound email needs to become a real, routed task — right project, right section, right label, right urgency, due tomorrow — not a bare line in the Inbox that someone has to sort later. Create task takes all of it in one request, so the workflow never needs a second call to move or label what it just created. Watch the priority direction: the API number is inverted against the apps, so urgent is 4 here even though Todoist labels it P1. Typing 1 files the task at the LOWEST priority and nothing errors.

Set Operation to createTask, then fill in:

Sets {{task.id}} (an opaque v1 string like 6XGgmFVcrG5RRjVr, not a number), {{task.content}}, {{task.url}} and {{task.task}} (the full object). url is built by the node rather than returned: Todoist removed the url property from the task object in API v1, so a later node that links a human to the task keeps working. Feed {{task.id}} into Add comment or Complete task downstream.