API & Apps framework

Hi everyone,I’m building a full-stack app using monday code (React UI + Express backend) and I want to make sure I’m following the correct authentication and authorization best practices.Current architectureUI → Backend authentication From the UI, I fetch monday.get("sessionToken") I send it to my backend in a request header In the backend, I verify/decode the sessionToken using my client_secret This works well for validating that the request comes from monday and from my app When decoding the sessionToken JWT, I noticed that it does not include a short-lived token that can be used to call monday APIs. OAuth & monday API calls I implemented a standard OAuth flow In the OAuth callback, I store the returned OAuth access token in Secure Storage When calling monday APIs from the backend, I retrieve that token and use it like this:  import { ApiClient } from "@mondaydotcomorg/api"; const mondayApiClient = new ApiClient({ token: accessToken }); const query = ` query { custom_ac

Hi everyone,I'm building a Monday App using React and Express. I'm using SecureStorage to store the OAuth access_token after the handshake.I have a concern regarding Scope Management and Token Validation.Currently, I define my required scopes in an Environment Variable (e.g., MONDAY_SCOPES="boards:read users:read"). In my authentication middleware, I simply check if an access_token exists in the storage. If it exists, I assume the user is authorized.The Logic: Env: SCOPES="boards:read" User authorizes: I get a token with boards:read and save it to SecureStorage. Later: I update my app features and change Env to SCOPES="boards:read boards:write". The Problem: My middleware still sees the old token in SecureStorage. It returns 200 OK for the auth check, but the API calls fail later because the token lacks the new boards:write permission. Here is a simplified version of my check:TypeScript // Middleware or Auth Check Logicexport async function checkAuth(req, res, next) { const secu

Hi everyone,I am building a React + Express app and deploying it using the Monday CLI (mapps code:push).I am currently implementing the OAuth flow, but I am stuck in a tedious manual loop regarding the Redirect URI.The Scenario: Frontend: I initiate the OAuth flow using window.location.origin to build the redirect URI dynamically. Backend: In my callback function, I use an environment variable (MONDAY_VERSION_URL) to validate the redirect_uri during the token exchange. The Code:Frontend (Initiating Auth):JavaScript const startOAuth = async () => { const { data: context } = await monday.get("context"); const currentOrigin = window.location.origin; // This changes on every deploy const redirectUri = `${currentOrigin}/oauth/callback`; const authUrl = `https://auth.monday.com/oauth2/authorize?client_id=${ context.app.clientId }&redirect_uri=${encodeURIComponent(redirectUri)}`; monday.execute("openLinkInTab", { url: authUrl });};Backend (Callback):TypeScript export async f

The monday.com Foundation Emergency Response Team is seeking a freelance developer to support an existing marketplace integration: KoboToolbox.The app is already built. The scope of work is ongoing technical support and bug fixing as issues arise.High availability during support requests is required. Our team operates in active emergency response contexts, where the stability and reliability of this integration is critical.This role is best suited for someone comfortable working under time-sensitive conditions and responding quickly when issues occur. We are a pro bono initiative from our Philanthropic Foundation, so we are looking for affordable services 🙏

Just thought I’d put this here.You can get the region of the monday account by decoding the shortLivedToken from an automation and getting the value of rgn and  extracting the first 2 letters for au, eu, il or us.It contains other information too, but what is aai?Example decoded shortLivedToken:{ "alg": "HS256", "typ": "JWT"}.{ "shortLived": true, "uid": 6......4, // user_id: number "actid": 2......2, // account_id: number "aid": 1......4, // app_id: number "aai": 2....1, // ???????????????????????????????????????? "rgn": "euc1", // region: string "exp": 1768213333, // token expiry: number "iat": 1768213033 // token issued at: number}.[Signature] 

Dear Community, I hope this message finds you all in good spirits. I would like to inquire about the fate of account Storage once a user decides to uninstall the app. Are the data wiped out entirely upon uninstallation, or does Monday.com retain any portion of this data for a certain period or under specific circumstances? Thank you all for your contributions and support. I eagerly await your insights and feedback.

Hi everyone,Has anyone found a way to support standard or managed templates in cases when an app stores board related data that should be duplicated when new boards are created from a template?In our case, the app stores column related metadata (in monday storage) used for column views (https://developer.monday.com/apps/docs/column-views). If a user adds our column to a managed template, we would like the app data to be automatically populated for all boards created from that template, so they don’t need to configure it in each boards. New boards created from template should have the app data populated from template as well.So far, we have not found a way to associate boards with the template they were created from. Having something like a parentBoardId or template reference on boards would make this much easier. Also having the app notified when a new board is created from template would allow us to duplicate the configuration straight away.

Hello, I have some questions regarding ability of creation custom Column Views:Will be there some mechanism of conversion of ordinary column to custom one, without losing data and attached automations? Now if application is deleted, custom column becomes unclickable instead of turning to usual column as common sense suggests. Is it a bug? Will custom column views be supported in mobile app?In general it would be good to know roadmap for Custom Column improvements at least for nearest quarter to plan what can be get from platform and for what workarounds should be prepared.

  Hi everyone,   Quick question about Monday.com app publishing:  We built a third-party CRM integration for another platform. Our Monday.com app is  OAuth-only - no UI, no features within Monday.com. Users authenticate via OAuth to  allow syncing CRM data to Monday boards.   Current issue: OAuth only works for our organization (dev mode). External users can't  authenticate.  Question: Must we publish to Monday.com Marketplace just for OAuth, even though the app   has no standalone features in Monday.com? Is there an alternative for production OAuth   access?   All user interaction happens in the external platform. The Monday app just enables API  access.   Thanks for any guidance!

 Hey everyone! 👋  I'm building a custom Monday.com app and running into an issue with custom field dependencies. Hoping someone here has encountered this before!  The Problem  I have two custom field types with a dependency relationship:  - Boardz (parent field) - Lists boards ✅ Working  - Viewz (dependent field) - Should list views from selected board ❌ Not working  When I select a board and then click on the view dropdown, no network request is made at all. The field just shows "Please select a board first" even though a board IS selected.  My Setup  Field Type 1 - "Boardz":  Type: List (Remote Options)  Remote Options URL: https://...app/integrations/remote-options/boards  Default field key: boardId  Dependencies: None  Status: ✅ Works perfectly - returns board list  Field Type 2 - "Viewz":  Type: List (Remote Options)  Remote Options URL: https://...app/integrations/remote-options/views  Default field key: viewId  Dependencies: Boardz (Field key: boardId)  Status: ❌ No network req

My automation has been successfully running the following mutation daily for weeks:```mutation updateItem($board_id: ID!, $item_id: ID!, $column_values: JSON!) { change_multiple_column_values( board_id: $board_id item_id: $item_id column_values: $column_values ) { id }}```With the following variables:```{ "board_id": 8767955035, "group_id": "topics", "column_values": "{\"date4\":\"2026-07-24 00:00:00\"}", "item_id": "8954255421"}```The `group_id` variable is set, but not used, so this is just a red herring.Today when it ran, I got the following response:```{ "data": {}, "errors": [ { "message": "Unauthorized field or type", "path": [ "change_multiple_column_values" ], "extensions": { "code": "UNAUTHORIZED_FIELD_OR_TYPE" } } ], "extensions": { "request_id": "601955a7-20fb-9f36-badf-826dbf31145e" }}```Nothing has changed on the app, automation, or board, but today it failed.Running the same mutation in the GraphQL pl

I am working on a Custom Widget. And I am adding a Field, of type Column and only allowing Timeline-type columns.  When I go to Settings in my implemented Custom Widget, it’s only showing the item columns, but no the subitem columns that mach with this criteriaI want to be able of selecting also which subitem column, of type Timeline, I want to use.

Hello everyone.I see monday recently added support for API Key Authentication in Credential Feature for workflow blocks, is there something similar for sentence recipe automations?But more importantly, would an app using API Key Authentication be accepted in the marketplace?I know OAuth is the recommended method and that’s what I’ve used for my other apps, but there are some third party services that don’t have OAuth.

Hello,We are experiencing an issue while configuring webhooks in the Developer Center. Specifically, we are unable to add our Live version URL; the system returns an error every time we attempt to save it but the version-specific URL is accepted without any issues. We have followed the official documentation and the setup guide, both of which recommend using the Live URL. Could you please help us understand why the Live URL is being rejected?Thank you for your assistance. 

I keep going back and forth between Monday.com’s API Reference API AI assistant and Gemini, and I keep getting conflicting answers on how this should look with neither one getting me to a working solution.  I keep getting 400 errors or errors about the file value being null.It appears that the Reference documentation doesn’t give enough information about how to do this with Python to get someone to a working solution.The confusion surrounds how to properly pass the $file variable into the python call (variable mapping and formatting).Can someone please post a basic python function that uses the inputs:API token, Column ID (of a files column), item ID, file_path (string representing the path to the file on your computer)in order to upload a file to the Files column of an item in Monday.com?Thanks. 

Hi there. I want to automatize a form, the idea is download the answers as a PDF file automatically. In monday, I use WorkForms Submission Viewer as a manual option to achieve it, I only go to the export button and the PDF File is downloaded: But, my objective is do the download process usign an API or a link or any kind of automatic process, because I need to storage each form’s answers as a PDF file into a repository.  I also found that forms generate this column call it “Submission link”, this links open a new browser tab with the answers: I could use that link to download the page with a curl, but the problem is that the images does not appear when I click into these links: I do not know if this a permission problem. I would appreciate any suggestions or comments.Thank you.   

Hello,I have a question regarding daily call limit for Pro tier. In the documentation it is mentioned that 10,000 requests is a soft limit and can be adjusted via API analytics dashboard. What makes it unclear to me, API analytics dashboard is only available for Enterprise accounts according to this page.Is it possible to change API call limit on Pro tier or not?

My company uses Monday and Kaseya Autotask.  We want to do our primary work in Autotask for support tickets but send and receive information in Monday for reporting to Management.  I’m a new worker tasked with learning how to make Monday communicate with Autotask.I’ve never done a lot of scripting or worked with APIs before, so I am on a learning curve.  We also have a third application called “Rewst” that allows you to automate workflows.  Rewst has native connections with Autotask, but only a generic API link with Monday.I’m looking for recommendations and advice on developing a learning path of getting one or both of these applications (Rewst and Autotask) communicating effectively with Monday.  I would appreciate any feedback from anyone else who might be utilizing these tools.Thank you for your consideration and input.

Hi ! We need to create an automation related to board creation/renaming/archiving/deletion We cannot find api to intercept board creation. only item creation

Hi Community,Is there perhaps a date when developer accounts get access to the multi level subitem boards? It seems it is still only Enterprise plans that have access. 

We recently hosted Daniel Hai, Senior Product Manager for API, MCP, and AI at monday.com, who shared the latest updates from API versions 2025-10 and 2026-01.If you build with our API, this session is worth a watch, it covers key improvements, upcoming changes, and what’s next for the monday platform.Watch the session on YouTube: 

I’m trying to setup Monday.com APIs in an instance of Microsoft’s Azure API Management. APIM consumes the GraphQL schema no problem but when I send a query to the Monday.com APIs through it I consistently get a 403 error from Cloudflare saying I’ve been blocked…    <div class="cf-wrapper cf-header cf-error-overview">        <h1 data-translate="block_headline">Sorry, you have been blocked</h1>        <h2 class="cf-subheadline">            <span data-translate="unable_to_access">You are unable to access</span> monday.com</h2>    </div>Has anyone else experienced this or have a solution to it?Thanks!     Jeff

Hello everyone. I need clarification on how to configure the Base URL in my integration features.When deploying to multiple regions, I receive separate URLs for each region:https://live1-service-X.us.monday.app https://live1-service-X.eu.monday.app https://live1-service-X.au.monday.appHowever, when configuring an integration feature (or app event webhook), I can only specify a single "Base URL" in the Feature Details section.My questions:Which URL should I enter as the Base URL - just one region? Does monday.com automatically route requests to the appropriate regional endpoint based on the user's location? Is there a way to use a dynamic or wildcard URL pattern to handle all regions? If I need to handle region routing myself in the Base URL, how can I determine the account's region?Any guidance on best practices for multi-region URL configuration would be greatly appreciated.

Hi, I'm interested in building my own integrations on the monday.com platform, but I'm finding it difficult to get started. Some of the documentation appears to be outdated, and I'm running into a few roadblocks:Step 7: "Choose Quickstart Integration - NodeJS template" this template doesn’t seem to exist anymore “> Prefer a video demo? [Watch here.](https://www.loom.com/share/b982f6b88fc0491f9e70fa424eb91638)” This video is no longer available I haven't been able to find clear guides explaining how the endpoints in the “quickstart-integrations” example project connect with the configuration required in the web UI. There also don't seem to be any videos showing how to create an integration. It's possible I'm missing something, but any advice or updated resources would be greatly appreciated.Thank you!

Dear marketplace partners and developers, We are excited to announce that registration is officially open for Partner Summit ‘26! There are limited spots to the event, so get your tickets early on the summit website!What is the Partner Summit? This is our partner event of the year. It’s your opportunity to gain insight into our 2026 strategies and focus areas, and network with leaders across the global ecosystem to maximize your offering and scale your business.The marketplace and builders track in the conference will focus on AI innovation, enterprise trust, and of course leading in the marketplace. Visit the website to learn more about the exciting agenda, track sessions, and sponsorship opportunities available. Where and when is it? The summit is happening February 17-18 in Prague.Keep in mind, we will have a closed marketplace community event in the evening of the February 16.  Where should I stay? The Hilton Prague is the Partner Summit venue this year, and we managed to secure a