# Todoist: L1 · Needs a person As of 6 Oct 2026, an AI agent can't use Todoist on its own: Invisible Cloudflare Turnstile on sign-up form. Source: https://agentdrives.com/tools/todoist?via=md · driven 6 Oct 2026 by AgentDrives's agent · Same level in 4 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 Gets in on its own nowhere yet: L1 · Needs a person. Our agent stopped at signup, where the email form at app.todoist.com runs an invisible Cloudflare Turnstile that rejected our agent's browser, with no visible challenge shown and no Google, Facebook or Apple account on hand. Dynamic client registration worked headless, but every token path still needed a logged-in account, so no key, call or work followed. Paying and cancelling both end in a hosted Stripe page per the docs, untested, and deletion has no documented route. The API, CLI and official MCP server stand ready once a person signs up and hands over a key. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L1 · Needs a person: There is an API, CLI or MCP server, but an agent can't get in on its own: a person has to sign up, verify or make the key. What it does once a person sets it up shows next to the level. - Find: Some docs for agents (An OpenAPI and an MCP server) - Access: Can't sign up - Use: Work not reached - Pay: Payment not reached - Leave: Leaving not reached - Next: let an agent sign up on its own - With an account set up by a person: not measured yet. ## Level history - 1 Oct 2026 (3 drives): L1 · Needs a person - 6 Oct 2026: L1 · Needs a person ## Part scores - Agent-ready setup: llms.txt not found, OpenAPI found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Turned away when they send the sign-up form. - Signed agents: The sign-up page opens. The check on the form still applies. - Agents in a person's browser: Not measured yet. Sign-up page checked 13 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: No llms.txt, no markdown version. - **Sign up**: Blocked: No API sign-up. The email form at app.todoist.com/auth/signup runs an invisible Cloudflare Turnstile that rejected our agent's browser ('Captcha verification failed. Please try again.'), with no visible challenge shown. Other routes are Google, Facebook or Apple accounts only, which we have no account for. - **Verify**: Not reached: Not reached: no account was created and no mail arrived. - **Key**: Not reached: Dynamic client registration works headless (POST todoist.com/oauth/register 201), but every token path (OAuth code + PKCE, personal token in settings, td auth login) needs a logged-in account. No device flow, no agent registration. The AS refused resource=https://api.todoist.com (invalid_target), the value in the API's own PRM. - **First call**: Not reached: GET /api/v1/tasks answers 401 JSON with Retry-After; no token could be obtained. - **First action**: Not reached: Not reached: no credentials. - **Pay**: Not reached: No 402, x402, MPP, UCP or registry listing found. The OpenAPI documents Stripe-hosted flows (usage_billing/top_up creates a hosted Stripe Checkout session; cancel_plan_with_redirect_to_stripe). The Pro upgrade checkout itself was not reached because no account could be created; from the docs only. - **Cancel**: Not reached: No plan was started. Docs: POST /api/v1/payments/cancel_plan_with_redirect_to_stripe returns a URL for a hosted cancellation flow, so cancelling ends in a web page. - **Delete**: Not reached: No account was created, so there was nothing to delete. No account-deletion operation found in the API reference. ## Does Todoist have an MCP server, and can an agent connect to it? Yes. Todoist has an official MCP server. The server is hosted and signs an agent in with OAuth. A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at sign up (it was blocked). ## How does an AI agent get a Todoist API key? Not reached: in the drive of 6 Oct 2026, sign-up stopped our agent first (it was blocked). Dynamic client registration works headless (POST todoist.com/oauth/register 201), but every token path (OAuth code + PKCE, personal token in settings, td auth login) needs a logged-in account. No device flow, no agent registration. The AS refused resource=https://api.todoist.com (invalid_target), the value in the API's own PRM. ## Paying the agent way Payment not reached. Ways to pay it offers an agent: Stripe Checkout. It has a free plan. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). From the drive of 6 Oct 2026. ## What an agent can do - Read the full API reference and OpenAPI 3.1.0 spec without an account - Discover the MCP server's OAuth setup (PRM, authorization server metadata) without an account - Register an OAuth client headless through dynamic client registration ## What it cannot do - Create a Todoist account: Invisible Cloudflare Turnstile on the email sign-up form rejected our agent's browser; no API sign-up - Get an API token or OAuth grant: All token routes need a logged-in account - Create, schedule or complete any task: No credentials ## Tips for the owner 1. Let signed agents through sign-up 2. Add an agent-friendly sign-up route 3. Offer the device flow for tokens 4. Accept the API's own resource indicator 5. Publish llms.txt and markdown docs Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in Task management - [TickTick](https://agentdrives.com/tools/ticktick.md?via=md): L3 · Does the work · [Todoist vs TickTick](https://agentdrives.com/compare/ticktick-vs-todoist?via=md) - [Akiflow](https://agentdrives.com/tools/akiflow.md?via=md): L1 · Needs a person · [Todoist vs Akiflow](https://agentdrives.com/compare/akiflow-vs-todoist?via=md) - [Taskade](https://agentdrives.com/tools/taskade.md?via=md): L1 · Needs a person · [Todoist vs Taskade](https://agentdrives.com/compare/taskade-vs-todoist?via=md) ## Tips for agent builders - You need a human to create the account: the email sign-up form runs an invisible Cloudflare Turnstile. - Once an account exists, use the official MCP server https://ai.todoist.net/mcp (OAuth via todoist.com, CIMD or DCR) or the REST API v1 with a personal token from Settings > Integrations. - Use resource=https://ai.todoist.net/mcp at /oauth/authorize; resource=https://api.todoist.com is refused with invalid_target. - Failed unauthenticated calls raise Retry-After quickly (5 s to 129 s); do not loop on 401s.