How to Automate Clio Manage with AI (Clio API Setup)
Clio Manage has a full public API, so an AI agent can work inside your firm’s actual system of record rather than talk about it from the outside. Four things that become possible once it’s connected.
End a client call, find the time entry already in Clio
When Fathom finishes writing up a call, work out which matter it belongs to, write the time entry in Clio with the duration and a proper billing description, and turn anything I committed to on the call into a task on that matter.
The call runs 40 minutes; the entry, the billing narrative, and the follow-ups are in Clio before you’ve opened another tab. Same shape with Fireflies, tl;dv, or Zoom’s own summaries — the notetaker keeps doing what it does, and the agent acts on the output. Time logged the same day is time you actually bill.
Let it read the scheduling order
When a PDF from the court arrives by email, pull out every date it states, create the Clio calendar entries on the right matter, add a task for each one, and email me what you found so I can check it.
The AI reads documents — PDFs, Word files, even a photo of a page — and Clio’s calendar and task endpoints are both writable, so the trip from “attachment arrives” to “dates are on the firm calendar” doesn’t involve a person retyping anything. It reports back what it extracted, because the whole point is that you eyeball it once instead of transcribing it.
Catch the time nobody logged
Every Friday at 4pm, compare this week’s calendar events and my sent email against the time entries in Clio. Show me anything billable that never got logged, matched to its matter, with a draft entry for each.
An hour-long call on the calendar with no matching activity in Clio is a billing gap, and it stays invisible unless somebody goes looking. The agent has both halves — Clio’s activities plus your calendar and inbox natively — so the comparison just runs. For most firms this is the one that pays for the setup in month one.
Get briefed before you walk into the meeting
An hour before any meeting with someone outside the firm, pull the matter from Clio with its recent activity, find the last email thread with them, research the external attendees on the web, and email me a one-page brief.
This is the workflow that reads least like automation and most like having someone. It’s stitching together three sources you’d otherwise open in three tabs, and it arrives without being asked.
Those are examples, not a menu — the same shape runs against any of Clio’s writable resources, and Carly’s workflow templates show the non-legal versions of the same patterns. In practice she interviews you about your matters, your billing habits, and your connected tools, then builds them with you one at a time.
Connect it in one prompt
The easiest way to do the setup is to let the agent do it. Copy the prompt below, paste it into Carly, and she walks you through the whole connection one step at a time — which page to open, what to type in each field, and the exact API call that proves it worked.
Paste it into Carly and follow along. Takes about ten minutes, and it's one-time.
Two things change it: Clio’s EasyStart tier can’t create developer apps at all, and firms outside the US instance need their region’s domains swapped in. Both are covered below.
Doing it by hand instead
Clio Manage has a full REST API, and reaching it takes no partner program, no app review, and no sales call. You register a private app, run the OAuth flow once, and you have credentials an agent can use to read and write matters, contacts, calendars, tasks, and time entries.
Everything below is Clio Manage on the US instance. (Clio Grow is a separate API on separate hosts, over on the Clio Platform portal at developers.api.clio.com.)
If your firm is on another region, swap every domain for your own:
| Region | Developer portal | API base URL |
|---|---|---|
| US | developers.clio.com | https://app.clio.com/api/v4 |
| EU | eu.developers.clio.com | https://eu.app.clio.com/api/v4 |
| CA | ca.developers.clio.com | https://ca.app.clio.com/api/v4 |
| AU | au.developers.clio.com | https://au.app.clio.com/api/v4 |
A token issued in one region is not valid against another, and apps don’t cross regions either — a firm operating in two of them needs a separate Clio account and a separate developer application in each.
Create the private app
Go to developers.clio.com, sign in with your normal Clio Manage login, and open Developer Apps. There’s no separate developer signup to complete first; your Clio credentials are the login.
Private apps aren’t reviewed by Clio and can’t be listed in the App Directory. Other than that they’re built exactly like public ones: same OAuth flow, same API.
One plan gate to know about: Clio’s docs say apps and integrations, private ones included, aren’t available on the EasyStart tier. Any paid tier above it works.
The form asks for these:
| Field | Required | What to put |
|---|---|---|
| Name | Yes | Anything. It appears on your own approval screen |
| Website URL | Yes | Any URL you control |
| Redirect URIs | Yes | https://app.clio.com/oauth/approval |
| Developer Terms of Service | Yes | Accept |
| App Permissions | Yes | See below |
| Description, Icons, Support URL, Deauthorization Callback | No | Skip |
The redirect URI is the field that trips people up. Normally OAuth redirects to a server you run, and you don’t have one. Clio publishes a special redirect for exactly this case, https://app.clio.com/oauth/approval, which embeds the authorization code in both the URL and the page title so you can read it off the screen instead of catching it in code.
The form rejects localhost; it requires https or http://127.0.0.1. And whatever you enter must match byte for byte in both the authorize URL and the token exchange, trailing slash included. A mismatch returns a bare 400 invalid_grant with no explanation of what’s wrong, which makes it by far the most common way this fails.
Permissions are per-resource, each with a read-only or read/write choice. Grant what you actually want the agent touching. Users and Calendars are enough to prove the connection works, and Matters, Contacts, Tasks, Activities, and Documents are the ones worth adding for real work.
One thing to get right the first time: once a user authorizes your app, their granted permissions are frozen even across token refreshes. Widening scopes later means going through authorization again. Missing a scope shows up as 403 ForbiddenError, or more confusingly as associated records that come back with most fields stripped and a redacted: true flag rather than an error.
Get the three Clio API tokens
Clio only supports the authorization code grant. There is no client-credentials path and no “just issue me an API key” option; asking for one returns unsupported_grant_type. You do the browser flow once and keep the refresh token.
Client ID and secret appear on the app’s page in the portal as soon as you create it. Clio also shows a secondary secret, which is a spare for rotation and isn’t needed here.
Authorization code. Open this in a browser, swapping in your client ID:
https://app.clio.com/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.clio.com%2Foauth%2FapprovalApprove, and the code lands in the address bar as code=... and in the page title as Success code=.... It’s valid for 10 minutes, so do the next step right away.
Refresh token. Exchange the code:
curl https://app.clio.com/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "code=THE_CODE" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "redirect_uri=https://app.clio.com/oauth/approval"The response carries access_token, expires_in: 2592000, and refresh_token. That’s a 30-day access token, and per Clio’s docs the refresh token does not expire, which is why this is a one-time setup. Store it like a password; it’s a permanent key to firm data. It dies only if the user revokes the app from inside Clio Manage, which kills both tokens at once.
Save them where the agent can reach them
Clio isn’t a native Carly connector, but it has a public REST API, which puts it in bring-your-own-key territory. Save all three values on carlyassistant.com/integrations under Custom API Keys, named exactly:
CLIO_CLIENT_IDCLIO_CLIENT_SECRETCLIO_REFRESH_TOKEN
Then add this to your preferences so the agent knows how to use them without being told each time:
For Clio API access, use the stored CLIO_CLIENT_ID, CLIO_CLIENT_SECRET, and CLIO_REFRESH_TOKEN to POST to
https://app.clio.com/oauth/tokenwithgrant_type=refresh_tokento get an access token, then GET the Clio API athttps://app.clio.com/api/v4/...with that token. Do not send an X-API-VERSION header.
That last line is not a stylistic preference. Clio’s v4 API accepts versioned and unversioned requests, and an unversioned request is served by the current default version. Send an invalid or deprecated version and you get 410 GONE, which is exactly what a hardcoded X-API-VERSION: latest produces, because latest isn’t a version. Omitting the header tracks the default cleanly. If you later want version pinning, pin to a real version number and plan to update it; Clio gives 90 days’ notice before a default changes and supports old versions at least a year.
Check that it worked
Ask the agent to GET https://app.clio.com/api/v4/users/who_am_i.json with a fresh access token. It’s the cheapest possible authenticated request, so if it returns your name and ID, every part of the chain works: app config, redirect match, secrets, and refresh. Anything that fails after that is a scope problem, not a setup problem.
Rate limits and what they mean for how you automate
50 requests per minute per access token during peak hours. Limits rise off-peak by an amount that varies per region, and peak is defined as 04:00–19:00 Pacific weekdays for US and Canada, 07:00–22:00 GMT for the EU, and 06:00–21:00 AET for Australia.
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset, and a 429 includes Retry-After. Clio explicitly says limits can change without notice and that you should read the headers rather than hardcode the number. There are no custom increases; Clio doesn’t grant them.
Fifty a minute is comfortable for event-driven work: a matter update, a time entry, a contact lookup. It’s tight for bulk operations, so a nightly full sync of a large matter list is the shape to avoid.
There’s also no sandbox. Clio doesn’t run a separate test environment, so you’re developing against a real account, either a 7-day trial or your firm’s live data.
Why a general assistant can’t run the workflows above
Every workflow at the top of this page starts with something happening: an email lands, a week ends, a matter changes status. Handing that to a general AI assistant hits a specific wall.
Both ChatGPT and Claude will now do work on a schedule, unattended. Neither reacts to events. A task that runs hourly still finds out an hour late, and one that runs each morning finds out tomorrow — the trigger is the clock, never the thing you actually care about.
“Summarize the Ramirez matter” is well inside what ChatGPT or Claude will do with Clio data you paste in. “Log the time entry the moment the client call ends” is not, because nothing is watching for the call to end.
That’s the half Carly is built for. It fires on the event, then runs the whole sequence: read the matter, draft the email, send it, write the time entry back to Clio. Because it also handles your inbox and calendar natively, updating Clio is one step inside a workflow rather than an isolated action.
Clio does ship AI of its own, now called Manage AI (it replaced Clio Duo). It drafts communications, summarizes matters, helps with billing, and turns scheduling orders into calendar events, all inside Clio Manage. That’s useful, and it’s a different job from this one: it works on Clio data within Clio, not across the inbox, calendar, and other tools where most of the trigger actually originates.
AI agents start at $35/month, and workflow steps that don’t use AI run free.
Frequently Asked Questions
Do I need a paid Clio plan to use the API?
Yes. Clio’s docs state that apps and integrations, including private apps, aren’t available on the EasyStart tier, and that you need a paid account to create apps and get a key and secret. There’s a 7-day free trial that works for testing.
How do I get a Clio API key?
Sign in at developers.clio.com with your Clio Manage login, open Developer Apps, and create an application. The Client ID and Client Secret appear on the app’s page. The refresh token comes separately, from running the OAuth authorization flow once.
Is Clio’s Manage AI the same as connecting Clio to an AI agent?
No. Manage AI, which replaced Clio Duo, works on Clio data inside Clio Manage. Connecting the API to an outside agent lets that agent act on Clio alongside your email, calendar, and other tools, and start work from events that happen outside Clio.
Is the Clio Grow API the same as the Clio Manage API?
No. Clio Grow uses the Clio Platform API, with its own developer portal at developers.api.clio.com, API host at api.clio.com, and OAuth host at auth.api.clio.com. Clio Manage uses developers.clio.com and app.clio.com/api/v4. Credentials and endpoints don’t carry across.
Can I use Clio’s API without OAuth?
No. Clio supports only the authorization code grant. There’s no client-credentials flow and no static API key; attempting grant_type=client_credentials returns unsupported_grant_type. You do the browser authorization once and store the refresh token.
Does the Clio refresh token expire?
No. Clio’s documentation states that refresh tokens do not expire, which is why setup is one-time. Access tokens last 30 days. A refresh token stops working only if the user revokes the app from within Clio Manage, which deauthorizes both tokens.
What redirect URI should I use if I don’t have a server?
https://app.clio.com/oauth/approval, Clio’s published redirect for desktop and mobile apps. The authorization code appears in the URL and in the page title, so you read it off the screen. Clio rejects localhost but accepts http://127.0.0.1.
What is the Clio API rate limit?
50 requests per minute per access token during peak hours, higher off-peak by a region-dependent amount. Responses include X-RateLimit-* headers, 429s include Retry-After, and Clio doesn’t grant custom increases.
Why am I getting a 400 invalid_grant from Clio?
Usually the redirect_uri in your token exchange doesn’t match the one registered on the app and used in the authorize URL. The match is exact, including trailing slashes. The other common cause is an expired authorization code, which is only valid for 10 minutes.
Why is my Clio request returning 410 GONE?
You’re sending an X-API-VERSION header with a value Clio doesn’t recognize. latest isn’t a valid version, and deprecated versions return 410 too. Omit the header to use the current default version, or pin to a real version number.
More: Best Clio integrations · How to connect Claude to Clio · Best AI tools for law firms
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
![18 Best AI Tools for Lawyers [2026]](/_vercel/image?url=_astro%2Fbest-ai-tools-lawyers.-rooY4P4.webp&w=320&q=100)
