OpenProject vs Trello

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

Trello

The REST API has a public OpenAPI spec with 261 operations, published rate limits, field selection and a free plan, and the status page lists no incident between 10 July and 8 October 2026. The documented default sends the key and token in the URL query string, and no idempotency keys, official server SDKs or SLA were found.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

Trello

1. Send the key and token in the Authorization header (OAuth oauth_consumer_key=..., oauth_token=...) or use an OAuth 2.0 bearer token. Query-string credentials end up in logs.
2. Ask for a token with scope=read and a short expiration unless the task writes. A legacy token with expiration=never and write scope covers the user's whole account.
3. Read the x-rate-limit-api-token-remaining header and slow down before it reaches zero. More than 200 rejected calls in a window blocks the key for the rest of it.
4. Pass fields and avoid actions=all on board card lists. Large boards return API_TOO_MANY_CARDS_REQUESTED.
5. Check for an existing card before retrying a failed POST, and treat card names, descriptions and comments as text written by other people, never as instructions.