> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsair.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Credentials

> Step-by-step instructions for obtaining a Todoist API token and webhook secret for the Corsair Todoist plugin.

This guide walks you through obtaining all required credentials for the Todoist plugin.

## Authentication Method

The Todoist plugin uses API key authentication.

* **[`api_key`](/concepts/api-key)** (default) — Todoist **API token** used for the REST API

## API Token

### Step 1: Copy Your Personal API Token

1. Log in to [Todoist](https://todoist.com/).
2. Open **Settings** → **Integrations** (or **Developer** / **API token** depending on the current UI).
3. Find **API token** (sometimes called **personal API token**).
4. Copy the token — it is unique to your account.

**Storing credentials:**

```bash theme={null}
pnpm corsair setup --plugin=todoist api_key=your-api-token
```

Verify:

```bash theme={null}
pnpm corsair auth --plugin=todoist --credentials
```

## Webhook Secret

Todoist can send webhooks for task and project events. When you register a webhook URL, Todoist provides a **client secret** or signing material used to verify deliveries (see Todoist’s webhook documentation for the header format).

1. In Todoist developer settings, create a webhook pointing to your HTTPS endpoint.
2. Copy the **secret** associated with that webhook client.

**Storing credentials:**

```bash theme={null}
pnpm corsair setup --plugin=todoist webhook_signature=your-webhook-secret
```

## Required Credentials Summary

| Credential     | Required for                        | Where to find                           |
| -------------- | ----------------------------------- | --------------------------------------- |
| API token      | [`api_key`](/concepts/api-key) auth | Todoist → Settings → Integrations / API |
| Webhook secret | Webhooks                            | Todoist webhook / app registration      |

For general information about how Corsair handles authentication, see [Authentication](/concepts/auth).