Invalid CSRF token in the Todoist SYNC API integrated with Google Apps Scrips

Question

What I'm trying to accomplish here is fetching all the tasks for the day and putting them in a Google Sheets file, so that I can track my progress. I tried mimicking a cURL request (the sample one for all projects) and after failing a few attempts on my own, I tried following this solution, but no luck so far.

This is my version of the code:

function myFunction() {
  var apiURL = "https://todoist.com/API/v9/sync";
  var queryString = "?token=<my_token>&sync_token=%27*%27&resource_types=[%22projects%22]";

  //Get params
  var fetchParameters = {};
  fetchParameters.method = 'get';
  fetchParameters.contentType = 'x-www-form-urlencoded';
  fetchParameters.muteHttpExceptions = true;

  //make request and return
  var response = UrlFetchApp.fetch(apiURL + queryString, fetchParameters);
  var syncData = JSON.parse(response.getContentText());
  Logger.log(syncData);
  return(syncData);
}

I'm getting this error:

{
    error_tag = AUTH_INVALID_CSRF_TOKEN,
    error_extra = {
        access_type = web_session,
        retry_after=2.0,
        event_id = f187e5d823184fd0997935e031b017ec
    },
    error_code = 410.0,
    http_code = 403.0,
    error = Invalid CSRF token
}

Can anyone help me please?

Edit: Here’s the API documentation. Sorry for the delay

I have to apologize for my poor experience. Unfortunately, I have no information about the method of API you want to use. So, can you provide the detaled official document of the method of the API you want to use? First, I would like to correctly understand your question. — Tanaike, Mar 27 '23 at 12:22
It seems that your provided official document URL `https://developer.todoist.com/sync/v9/#overview` is the top of the document page. It seems that there are a lot of methods in the API. But, unfortunately, I cannot know the method you want to use from your question. I think that the reason that I cannot understand what you want to do is due to my poor English skill. I have to apologize for this. So, I asked a detailed official document of the method of the API you want to use. Please provide the direct link to the official document of the method you want to use. — Tanaike, Mar 27 '23 at 12:49
@Tanaike oh sorry, maybe you meant this? https://developer.todoist.com/sync/v9/#get-all-projects I was just trying to get the API to work, I didn't even get to the point of trying the method I needed (which is the "get tasks" one) — Clarissa De Simoni, Mar 27 '23 at 14:25

score 1 · Accepted Answer · answered Mar 27 '23 at 17:33

You're missing the API token in your request. It's supposed to go in the Authorization header, and it appears that you're adding it as the token= parameter in your URL, but the Todoist documentation doesn't say anything about adding it as a URL parameter:

[You need] an authorization header containing the user's API token [...] You can find your token from the Todoist Web app, at Todoist Settings -> Integrations -> API token.

So assuming that you already have your token from their integrations page, try to add it to the Authorization header like this:

  fetchParameters.headers = { 'Authorization':' Bearer '+'<YOUR_TOKEN>'}

Modified code:

function myFunction() {
  var apiURL = "https://todoist.com/API/v9/sync";
  var queryString = "?sync_token=%27*%27&resource_types=[%22projects%22]";

  //Get params
  var fetchParameters = {};
  fetchParameters.method = 'get';
  fetchParameters.contentType = 'x-www-form-urlencoded';
  fetchParameters.muteHttpExceptions = true;
  fetchParameters.headers = { 'Authorization':' Bearer '+'<YOUR_TOKEN>'}

  //make request and return

  var response = UrlFetchApp.fetch(apiURL + queryString, fetchParameters);
  var syncData = JSON.parse(response.getContentText());
  Logger.log(syncData);
  return(syncData);
}

It worked, thank you! I put the token in the queryString but evidently it was misplaced — Clarissa De Simoni, Mar 27 '23 at 18:44

Invalid CSRF token in the Todoist SYNC API integrated with Google Apps Scrips

1 Answers1