Help Center / API and developers /
Connecting AI tools to Plutio
AI assistants like Claude, ChatGPT, Cursor, and others can read and write your Plutio workspace data through the same REST API that platforms like Zapier, Make, and n8n use. There is no separate AI integration in Plutio. The AI authenticates with an API client you create in your settings, and you guide it with a few details and a clear prompt.
What this enables
Once an AI tool can call the Plutio API on your behalf, you can ask it to do things like:
- Create a proposal, invoice, contract, project, or task from a short brief.
- Read your contacts, projects, or tasks and summarise them.
- Update statuses, assign people, set due dates, or attach custom field values in bulk.
- Pull invoice or time tracking data into reports the AI builds outside Plutio.
The AI is limited to what the API itself supports. API overview lists the areas covered. Any action the AI takes runs as the user who created the API client, with that user's role and permissions.
What you'll need
- The Owner or Co-owner role in your workspace. Only owners and co-owners can open Settings > API manager and create an API client.
- An AI tool that can make HTTP requests. Claude (with web access or a code interpreter), ChatGPT (with code interpreter or a browsing-enabled GPT), Cursor, custom scripts, and any agent platform that can call REST endpoints all work.
- A few minutes to set things up. The whole process is creating one API client, copying four pieces of information, and asking the AI to use them.
Step 1: Create an API client
Go to Settings > API manager and create a new API client. Plutio generates a Client ID and a Client Secret. Both stay visible on the client page whenever you need them. Copy them into a safe place (a password manager, for example) and keep them private.
Full step-by-step instructions are in API client management.
Step 3: Ask the AI to generate an access token
Plutio uses OAuth2 with the client_credentials grant. Ask the AI to send a POST request to https://api.plutio.com/v1.11/oauth/token with these form fields:
grant_type=client_credentialsclient_id=YOUR_CLIENT_IDclient_secret=YOUR_CLIENT_SECRET
The response contains an accessToken and an accessTokenExpiresAt timestamp. The token is valid for 72 hours. When it expires, the AI can call the same endpoint again to get a fresh one.
A simple prompt that works:
"Use the Plutio API at https://api.plutio.com/v1.11. Generate an OAuth access token by POSTing to /oauth/token with grant_type=client_credentials, my client ID is X, my client secret is Y. The Plutio docs are at https://docs.plutio.com/#getting-started-generate-access-token. Show me the token when you have it."
Step 4: Test with a simple request
Once the AI has a token, every request needs two headers:
Authorization: Bearer ACCESS_TOKENbusiness: YOUR_SUBDOMAIN
A safe first test is creating a draft proposal or task, since you can review or delete it inside Plutio if anything is off.
Example prompt:
"Using the access token, create a Plutio task called 'API connection test' in my workspace. The endpoint reference is at https://docs.plutio.com. Confirm the response and give me the task ID."
If the AI gets a 400 error mentioning "Business undefined is not enabled for this client", the business header is missing or the API client is not enabled for that workspace. Common API errors covers the rest.
What the AI can read and write
The AI uses the same REST endpoints any other integration uses. The full list of resources, fields, and filters lives in the public reference at docs.plutio.com. Major areas include projects, tasks, invoices, proposals, contracts, contacts, forms, time entries, bookings, wiki pages, and conversations. Each one supports the standard create, read, update, and delete operations.
Sharing the docs link in your prompt usually helps. The AI can read it and figure out the exact endpoint and payload for what you want to do.
Keep your credentials safe
- Treat the client secret like a password. Never paste it into a public chat, a shared screen recording, a public GitHub repo, or a website front-end.
- The access token is also sensitive. Anyone who has a valid token can act as you for the next 72 hours.
- If something looks wrong, delete the API client from Settings > API manager. That immediately stops any token issued from those credentials from working.
Limits and gotchas
- Rate limit: 1,000 requests per hour per API client. Going over returns
429 Too Many Requests. The AI should pause and retry. - Token lifetime: 72 hours, then call
/oauth/tokenagain with the same credentials. - Permissions: the AI inherits the role and entity permissions of the user who created the API client. If that user cannot see a project, neither can the AI.
- Workspace scope: each API client is enabled for one or more workspaces. The
businessheader on every request must match one of those subdomains. - The AI can make mistakes. Start with reads and drafts, review what it does, and only let it run destructive actions (like delete) once you trust the prompt and the response.
Reference docs
The full API reference, including every endpoint, field, and filter, is at https://docs.plutio.com. Specific anchors that are useful when prompting an AI:
- Generate access token
- Endpoint sections for each resource (proposals, invoices, tasks, projects, etc.) on the same page.
Other related help articles: API overview, API client management, Common API errors, and API and third-party connections.
