OpenProject vs Shortcut

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

Shortcut

REST API v3 and the hosted MCP server are included on the Free plan, with downloadable OpenAPI files and OAuth scopes down to story or comment writes on the MCP side. The API still accepts the token in a query string, and no idempotency keys, Retry-After header, uptime SLA or API changelog were found in the reviewed documentation.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

Shortcut

1. Send the v3 token in the Shortcut-Token header. v4 (alpha) takes Authorization: Bearer with sct_ro_ or sct_rw_ tokens, and v3 tokens don't work there.
2. Create a story with name and workflow_state_id. Sending both workflow_state_id and project_id, or neither, is rejected.
3. Use GET /api/v3/search/stories with detail=slim, page_size (1 to 250) and the next token. Many other v3 list endpoints return every record at once.
4. Stay under 200 requests a minute and add your own backoff on 429, because no Retry-After header is documented.
5. For MCP, connect to https://mcp.shortcut.com/mcp and request only the scopes needed, such as read or story-write.