ChatGPT Actions

Supported integration

The source adds eight task operations for private custom GPT Actions: list/search, summary, read, create, update, archive, complete, and restore. The actual deployment must expose a valid public HTTPS endpoint. The schema is generated from the same routes the server executes at /openapi-chatgpt.json; it returns 503 until an HTTPS public base URL is configured.

Setup

1. Deploy the reviewed source on your application origin and set TIMEBOARDAPP_BASE_URL=https://tasks.example.com. Do not use this project's static website as the API server.
2. Sign in to POST /api/auth/token through a trusted client. Use that short-lived access token to call POST /api/integrations/tokens with a descriptive name, expiry (1–90 days), and allow_write (false by default).
3. Save the returned tba_... token in the GPT editor's Action authentication setting: API key, Bearer. It is shown only once. Never put it in the GPT's instructions, schema, or conversation.
4. Import the OpenAPI schema from your deployment's /openapi-chatgpt.json. Keep the custom GPT private; an API-key-backed shared GPT would otherwise act with the token owner's access.
5. Exercise read-only operations first. Enable writes only after reviewing permissions and testing confirmation behavior in the GPT editor. Marking an operation consequential is a safety instruction to the client, not a replacement for server authorization.

POST /api/integrations/tokens
Authorization: Bearer <your-short-lived-access-token>
Content-Type: application/json

{"name":"Private task assistant","expires_days":30,"allow_write":false}

Boundaries

Integration tokens are hashed at rest, individually revocable through DELETE /api/integrations/tokens/{id}, expire, and stop working after a password change/reset. They cannot authenticate to the original administrator API. Even an administrator's integration token can access only that administrator's own tasks, not another user's or a subordinate's tasks.

Listing supports pagination with a maximum of ten items and an additional serialized-response budget. Long descriptions/tags are visibly truncated through content_truncated; do not silently overwrite a complete description with a truncated read result. Supply a timezone offset for due dates. All write operations carry x-openai-isConsequential: true. Task descriptions and URLs are untrusted data, never instructions to the assistant.

Not claimed

This implementation is not an OpenAI model-serving endpoint, a Chat Completions clone, a native ChatGPT MCP app, or multi-user OAuth. Those are different interfaces. Shared multi-user deployment requires authorization-code OAuth and consent; native ChatGPT apps require a separate MCP implementation. Schema and local integration tests cannot prove that a specific account's GPT editor, public TLS deployment, or live conversation has passed acceptance testing.

Acceptance before use

Import the deployed schema; verify TLS; confirm list/search pagination; verify a second user's task is inaccessible; test a read-only token rejecting writes; approve one task creation/completion; revoke the token and verify access fails. Never expose admin backups, global credentials, arbitrary HTTP requests, or destructive database operations as Actions.

Official references: Action authentication and production requirements.