# init.Tasks API

init.Tasks is a to-do app that looks like a terminal. This is its public API: a REST surface at `https://api.inittasks.com/v1`, and an MCP server so an AI client can use the same data with the same permissions.

// One thing shapes every design decision below, so it comes first.

## The server cannot read your tasks

Every content field is encrypted on the user's device before it is stored. Titles, notes, tags, dates, file names, attachment text — the database holds ciphertext, and the key never reaches the server as anything the server can use on its own.

When you call this API, the credential you hold carries the key, and the server decrypts *for that request only*. So:

- [✓] You get plaintext. `GET /v1/todos` returns real titles.
- [ ] There is no server-side search over content. `/v1/search` runs after decryption, inside your request.
- [ ] There is no `todo.completed` webhook. `status` is encrypted; the server cannot tell a completion from a rename.
- [ ] An administrator cannot read a user's tasks, and neither can a database backup.

If a feature would require the server to understand content while nobody is asking for it, that feature does not exist here. That is the trade, and it is deliberate.

## Two kinds of credential

| | for | how |
|---|---|---|
| **Personal access token** | your own scripts, a cron job, one-off automation | create one in the app, paste it into your code |
| **OAuth 2.1** | an app other people will use | register, send the user to approve, get a token |

Both carry scopes, both are revocable, and both stop working the moment the user changes their password or their encryption key. See [authentication](/authentication).

## Start here

- [Quickstart](/quickstart) — a key, a curl, your first to-do, in five minutes.
- [Authentication](/authentication) — tokens, the approval flow, scopes.
- [Encryption](/encryption) — what the server sees, and what a grant actually hands over.
- [Reference](/reference) — every route, generated from the OpenAPI document.
- [Webhooks](/webhooks) — thin events, signature verification, retries.
- [MCP](/mcp) — connect Claude, ChatGPT, Cursor and friends.

## Ground rules

- The base URL is `https://api.inittasks.com/v1`. JSON only.
- `/oauth/*`, `/.well-known/*`, `/healthz` and `/openapi.json` sit at the host root — they are not versioned data.
- `/v1` is stable once announced; breaking changes go to `/v2` and `/v1` keeps serving for at least six months. See [versioning](/versioning).
- Errors are [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) problem+json. Branch on `type`, never on `detail`.
- `GET https://api.inittasks.com/openapi.json` is the machine contract. Every response links to it.
- It is free, and there is no approval process for your app.