Asana

Connect Asana with your own OAuth app so agents can review project health and workload, and change tasks through your Approvals

Connect Asana and CloudThinker agents can review a project’s open work, ownership gaps, and due dates, rank what’s on your plate this week, and create, update, or delete a task through your approvals. The connection uses Asana’s hosted MCP server (Model Context Protocol, a standard way for agents to call a tool) and signs in with OAuth through an Asana app your team creates. You create the app once, then sign in.

Prerequisites

• An Asana account with access to the projects and tasks agents should work with.
• Access to the Asana developer console to create an app, or the app’s Client ID and Client secret from whoever created it.
• Edit permission on connections in your CloudThinker workspace.
• No existing Asana connection in this CloudThinker workspace. Each CloudThinker workspace holds one.

Asana’s MCP server doesn’t let CloudThinker register an app for you, so each CloudThinker workspace brings its own Asana app. The app’s settings control which Asana workspaces can authorize it.

Setup

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Asana and click Connect. The Connect Asana dialog has three sections, matching the steps below. Keep it open until you finish.

1. Copy the redirect URL

   Under Copy the redirect URL, click the copy button next to the URL.

2. Create an Asana app

   Under Create an Asana app, click Open Asana developer console. In Asana, click Create new app, name it CloudThinker, choose MCP app, and create it.

   In the app, open OAuth, add the redirect URL you copied, and save. Then open Manage distribution and allow only the Asana workspace CloudThinker should use. Allow all workspaces only if a specific workspace won’t work for you.

   Back in CloudThinker, click Mark as Configured.

   Success state: the button changes to Configured.

3. Enter app credentials

   Under Enter app credentials, copy the app’s Client ID and Client secret from the app’s OAuth settings in Asana into the matching fields, then click Connect.

   Asana’s sign-in page opens. Sign in, select the Asana workspace CloudThinker should use, and approve access.

   Success state: the dialog closes and the Asana connection shows Connected.

Connection details

Field	Description
Client ID	Identifies the Asana MCP app you created for this CloudThinker workspace
Client secret	Authenticates that app when CloudThinker exchanges and refreshes tokens. Stored encrypted with the connection and never shown again
OAuth tokens	Issued by Asana when you approve access, then stored encrypted by CloudThinker
Selected workspace	The one Asana workspace you picked during sign-in. Agents only see teams, projects, people, and tasks in it

Every time you connect through the Connect Asana dialog, you enter the Client ID and Client secret again and click Mark as Configured again. Keep them in your team’s password manager.

Required permissions

Agents act as the Asana user who signed in. They reach only the projects and tasks that user can open in the selected workspace, and changes show up in Asana under that user’s name.

Access	Covers	Approval
Read	The connected user, people, teams, projects, tasks, assigned work, due dates, and project status	Runs without asking
Write	Create a task, update a task (name, notes, assignee, due date, completion), delete a task	A write, so Approvals decides
Not available	Creating projects, adding comments, posting project status updates	Off by design, because Asana offers no way to delete them afterward

Sign in with an Asana user whose access matches the projects CloudThinker needs. Agents can never see a project that user can’t open.

Agent capabilities

Capability	What agents can do
Workspace discovery	Identify the connected user, visible teams, projects, and assigned tasks
Project health	Review one project’s open work, unassigned tasks, and due-date pressure
Workload review	Sort the connected user’s tasks into overdue, upcoming, and undated
Task investigation	Read one task’s project, assignee, dates, notes, and completion state
Status review	Compare Asana project status across projects matching a name or keyword
Task changes	Create, rename, reassign, reschedule, complete, or delete one task at a time

Before every update or delete, the agent reads the task and reports its earlier values. To undo an update, ask the agent to set those values back.

Deleting an Asana task is permanent. It also deletes the task’s subtasks, unless a subtask belongs to another project. The agent shows you the task record before you approve, and that record is the only copy left afterward.

Due dates in Asana are calendar dates. “Overdue” is judged in UTC unless you name your time zone, for example “in Asia/Ho_Chi_Minh time”.

Verify the connection

Discover my Asana workspace and summarize the visible teams, projects, and tasks assigned to me

A working connection names your real teams and projects. An authorization error means the app isn’t allowed in that workspace or the sign-in expired.

Example prompts

Review the Mobile app launch project in Asana and flag overdue or unassigned tasks
Rank the Asana tasks assigned to me that need attention this week, in America/New_York time
Which Asana projects matching "Q4" have a status of off track or at risk?
Create a task named "Prepare launch checklist" in the Mobile app launch project, due 2026-11-15
Reassign the task "Update DNS records" to Priya and move its due date to Friday

Troubleshooting

CloudThinker rejects the app credentials

Copy the Client ID and Client secret again from the same Asana app. Check that no spaces were added while copying, then retry.

Asana reports a redirect URL mismatch

The redirect URL in the Asana app doesn’t match CloudThinker’s. Copy the full URL from Copy the redirect URL in the dialog again, paste it into the app’s OAuth settings, and save. Then click Mark as Configured and retry.

Asana says the app is unavailable

The app isn’t allowed in the workspace you picked. Open Manage distribution for the app and allow that workspace, or all workspaces. A specific-workspace setting with no workspace selected blocks every sign-in.

Projects or tasks you expect are missing

The signed-in user may not have access, or you picked a different Asana workspace during sign-in. Confirm that user can open the project in Asana, or disconnect and reconnect with the right workspace.

A task can't be found

The task may be deleted, hidden from the signed-in user, or in another workspace. Ask the agent to discover the workspace again and find the task by name.

Requests fail with 401 Unauthorized

The Asana sign-in expired or was revoked. Open Asana in More → Workspace settings → Connections and click Connect, then enter the app credentials again.

A task change is stuck waiting

The write is waiting for a person. Look for the approval card in the chat and click Approve, or Notify approvers if you can’t approve yourself.

Asana reports a rate limit or a temporary error

For a rate limit (429), wait the time Asana asks for, then retry. The limit depends on your Asana plan: see Asana’s rate limits. For a server error, retry once. If it repeats, the problem is on Asana’s side.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Treat the Client secret like a password. Keep it out of source control and chat. CloudThinker stores it encrypted with the connection.
• Limit the app’s distribution. Allow only the Asana workspace CloudThinker needs, rather than all workspaces.
• Pick the signing-in user on purpose. Every read and write runs with that user’s Asana access. When they leave, reconnect with a different account.

Related

Approvals

Decide which Asana changes run on their own and which wait for a person

ClickUp Connection

Connect ClickUp for list triage, workload, and task changes