开发者文档

BASE=https://tasktask.net/api/v1
TOKEN=tt_pat_xxx

# 1. 列出项目
curl -s -H "Authorization: Bearer $TOKEN" "$BASE/projects"

# 2. 在项目下新建任务
curl -s -X POST "$BASE/projects/p_xxx/tasks" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"task":"写发布说明","dueDate":"2026-09-30","priority":"high"}'

# 3. 更新任务状态
curl -s -X PATCH "$BASE/tasks/t_xxx" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status":"done"}'

import os, requests

BASE = "https://tasktask.net/api/v1"
HEAD = {"Authorization": "Bearer " + os.environ["TT_TOKEN"]}

# 1. 列出项目
projects = requests.get(f"{BASE}/projects", headers=HEAD).json()["projects"]
pid = projects[0]["id"]

# 2. 新建任务
task = requests.post(f"{BASE}/projects/{pid}/tasks", headers=HEAD, json={
    "task": "写发布说明",
    "dueDate": "2026-09-30",
    "priority": "high",
}).json()["task"]

# 3. 更新状态
requests.patch(f"{BASE}/tasks/{task['id']}", headers=HEAD,
               json={"status": "done"})

const BASE = 'https://tasktask.net/api/v1';
const HEAD = {
  Authorization: 'Bearer ' + process.env.TT_TOKEN,
  'Content-Type': 'application/json',
};

const call = (p, opt) =>
  fetch(BASE + p, { headers: HEAD, ...opt }).then(r => r.json());

const { projects } = await call('/projects');
const { task } = await call(`/projects/${projects[0].id}/tasks`, {
  method: 'POST',
  body: JSON.stringify({ task: '写发布说明', priority: 'high' }),
});
await call('/tasks/' + task.id, {
  method: 'PATCH',
  body: JSON.stringify({ status: 'done' }),
});

const crypto = require('crypto');
const express = require('express');
const app = express();

// 关键：必须拿"原始请求体"验签，不能先 JSON.parse
app.post('/tasktask-webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.get('X-TaskTask-Signature') || '';
    const ts  = req.get('X-TaskTask-Timestamp') || '';
    const raw = req.body.toString('utf8');

    const expected = crypto.createHmac('sha256', process.env.TT_WEBHOOK_SECRET)
      .update(ts + '.' + raw)
      .digest('hex');

    const ok = sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
    if (!ok) return res.status(401).end();

    // 先应答，再处理，避免对方超时
    res.status(200).end();

    const payload = JSON.parse(raw);
    const deliveryId = req.get('X-TaskTask-Delivery');
    handleEvent(payload, deliveryId);   // 用 deliveryId 做幂等
  });

import hmac, hashlib
from flask import Flask, request

app = Flask(__name__)
SECRET = b"tt_whs_xxx"

@app.post("/tasktask-webhook")
def hook():
    sig = request.headers.get("X-TaskTask-Signature", "")
    ts  = request.headers.get("X-TaskTask-Timestamp", "")
    raw = request.get_data()                      # 原始字节，不要用 request.json

    expected = hmac.new(
        SECRET, (ts + ".").encode() + raw, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, sig):
        return "", 401

    payload = request.get_json()
    handle_event(payload, request.headers.get("X-TaskTask-Delivery"))
    return "", 200