Chatwork
MESSAGING · MESSAGING
Chats, messages, tasks, and files in the Chatwork account they connected.
Connecting Chatwork in practice
Chatwork runs two limiters: 300 requests per 5 minutes overall, and a separate 10 calls per 10 seconds on message posting and task creation, per room. The OAuth access token lives 30 minutes and the refresh token 14 days unless offline_access is requested, while the alternative API token never expires and carries the whole account.
Scopes that draw scrutiny
rooms.all:read_writeRead and write across every room the user belongs to, rather than the one the agent was pointed at.rooms.messages:writePosts messages as the authorizing user, which is the scope that makes an agent indistinguishable from the person in a group chat.contacts.all:read_writeReads and modifies the user’s whole contact list, so it reaches people outside the rooms in scope.users.all:readReads all user information rather than only the authorizing user’s own profile.offline_accessTurns the 14-day refresh token into an indefinite one, which is the difference between a session and permanent access.
Rate limits
- 300 requests per 5 minutes, reported through the x-ratelimit-remaining and x-ratelimit-reset response headers.
- Message posting and task creation: 10 calls per 10 seconds. Over that, 429 with "Rate limit for message posting per room exceeded."
Worth knowing
- OAuth access tokens expire after 30 minutes, so an agent doing anything long-running refreshes mid-task rather than at session start.
- The two authentication modes have very different blast radius: an API token sent as x-chatworktoken has no expiry and full account access, while OAuth can be narrowed to rooms.messages:read.
- Chatwork states the token must be sent in the HTTP request header and never in the URL query string.
- Scope names distinguish rooms:write (create a room) from rooms.info:write and rooms.members:write, so "can it post" and "can it add people" are separate grants that neither implies.
Checked against Chatwork API endpoints and limits (2026-09-29), Chatwork OAuth (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Chatwork behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.