build on task data the server cannot read

init.Tasks API

init.Tasks is a to-do app that looks like a terminal. This is its public API: a REST surface at https://api.inittasks.com/v1, and an MCP server so an AI client can use the same data with the same permissions.

One thing shapes every design decision below, so it comes first.

The server cannot read your tasks

Every content field is encrypted on the user's device before it is stored. Titles, notes, tags, dates, file names, attachment text — the database holds ciphertext, and the key never reaches the server as anything the server can use on its own.

When you call this API, the credential you hold carries the key, and the server decrypts for that request only. So:

[✓] You get plaintext. GET /v1/todos returns real titles.
[ ] There is no server-side search over content. /v1/search runs after decryption, inside your request.
[ ] There is no todo.completed webhook. status is encrypted; the server cannot tell a completion from a rename.
[ ] An administrator cannot read a user's tasks, and neither can a database backup.

If a feature would require the server to understand content while nobody is asking for it, that feature does not exist here. That is the trade, and it is deliberate.

Two kinds of credential

	for	how
Personal access token	your own scripts, a cron job, one-off automation	create one in the app, paste it into your code
OAuth 2.1	an app other people will use	register, send the user to approve, get a token

Both carry scopes, both are revocable, and both stop working the moment the user changes their password or their encryption key. See authentication.

Start here

Quickstart — a key, a curl, your first to-do, in five minutes.
Authentication — tokens, the approval flow, scopes.
Encryption — what the server sees, and what a grant actually hands over.
Reference — every route, generated from the OpenAPI document.
Webhooks — thin events, signature verification, retries.
MCP — connect Claude, ChatGPT, Cursor and friends.

Ground rules

The base URL is https://api.inittasks.com/v1. JSON only.
/oauth/*, /.well-known/*, /healthz and /openapi.json sit at the host root — they are not versioned data.
/v1 is stable once announced; breaking changes go to /v2 and /v1 keeps serving for at least six months. See versioning.
Errors are RFC 9457 problem+json. Branch on type, never on detail.
GET https://api.inittasks.com/openapi.json is the machine contract. Every response links to it.
It is free, and there is no approval process for your app.