Skip to content

integrations/clickup: Add ClickUp integration script.#921

Open
sathwikshetty33 wants to merge 1 commit into
zulip:mainfrom
sathwikshetty33:clickup-integration-script
Open

integrations/clickup: Add ClickUp integration script.#921
sathwikshetty33 wants to merge 1 commit into
zulip:mainfrom
sathwikshetty33:clickup-integration-script

Conversation

@sathwikshetty33

@sathwikshetty33 sathwikshetty33 commented Jul 24, 2026

Copy link
Copy Markdown

This is a replacement PR for #824 .

The original PR used an OAuth approach. The bot was created without a ClickUp token, and the script ran an OAuth flow to generate one. That token, along with the team ID, was then appended to the bot's webhook URL as query parameters, so the key essentially lived in the URL.

The server side has since moved on. It now reads the ClickUp token from the bot's config data, where it is a required option at bot creation, and uses it to call ClickUp's API and turn the entity IDs in webhook payloads into readable names.

That is what rules OAuth out. The config option needs the token when the bot is created, but an OAuth flow can only return a token after the bot and its webhook URL already exist, so there is no point at which OAuth could provide what bot creation asks for.

This PR therefore drops OAuth entirely. Instead, the user generates a personal API token from the ClickUp UI (Settings > ClickUp API > API Token), enters it when creating the bot, and passes the same token to this script to register the webhook. The script now registers a plain webhook URL with nothing appended, since the server takes the team ID straight from the payload and the token from config.

Fixes part of zulip/zulip#26529
CZO: thread

How did you test this PR?
Manually invoked the script and added unit tests.
Testing video

Self-review checklist
  • Self-reviewed the changes for clarity and maintainability
    (variable names, code reuse, readability, etc.).

Communicate decisions, questions, and potential concerns.

  • Explains differences from previous plans (e.g., issue description).
  • Highlights technical choices and bugs encountered.
  • Calls out remaining decisions and concerns.
  • Automated tests verify logic where appropriate.

Individual commits are ready for review (see commit discipline).

  • Each commit is a coherent idea.
  • Commit message(s) explain reasoning and motivation for changes.

Completed manual review and testing of the following:

  • Visual appearance of the changes.
  • Responsiveness and internationalization.
  • Strings and tooltips.
  • End-to-end functionality of buttons, interactions and flows.
  • Corner cases, error conditions, and easily imagined bugs.

@sathwikshetty33
sathwikshetty33 force-pushed the clickup-integration-script branch 2 times, most recently from 8cd558a to 1d63b18 Compare July 24, 2026 06:16
ClickUp payloads contain only entity IDs, so the server needs a stored
ClickUp token to resolve them to names. Use a personal API token instead
of OAuth: the token must be present in the bot config at bot-creation
time, whereas an OAuth flow can only issue one after the bot and webhook
URL already exist.

Fixes part of zulip/zulip#26529

Co-Authored-By: pieterck <pieterceka123@gmail.com>
@sathwikshetty33
sathwikshetty33 force-pushed the clickup-integration-script branch from 1d63b18 to daa1323 Compare July 24, 2026 06:22
@sathwikshetty33

Copy link
Copy Markdown
Author

@0xthedance tagging you for a review.

@sathwikshetty33

Copy link
Copy Markdown
Author

@zulipbot add "buddy review"

@zulipbot zulipbot added the buddy review GSoC buddy review needed. label Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

buddy review GSoC buddy review needed. size: XL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants