How to Automate Clio Manage with AI (Clio API Setup)

Clio Manage has a full public API, so an AI agent can work inside your firm’s actual system of record rather than talk about it from the outside. Four things that become possible once it’s connected.

End a client call, find the time entry already in Clio

When Fathom finishes writing up a call, work out which matter it belongs to, write the time entry in Clio with the duration and a proper billing description, and turn anything I committed to on the call into a task on that matter.

The call runs 40 minutes; the entry, the billing narrative, and the follow-ups are in Clio before you’ve opened another tab. Same shape with Fireflies, tl;dv, or Zoom’s own summaries — the notetaker keeps doing what it does, and the agent acts on the output. Time logged the same day is time you actually bill.

Let it read the scheduling order

When a PDF from the court arrives by email, pull out every date it states, create the Clio calendar entries on the right matter, add a task for each one, and email me what you found so I can check it.

The AI reads documents — PDFs, Word files, even a photo of a page — and Clio’s calendar and task endpoints are both writable, so the trip from “attachment arrives” to “dates are on the firm calendar” doesn’t involve a person retyping anything. It reports back what it extracted, because the whole point is that you eyeball it once instead of transcribing it.

On the platform choice itself, Clio vs MyCase covers the comparison.

Catch the time nobody logged

Every Friday at 4pm, compare this week’s calendar events and my sent email against the time entries in Clio. Show me anything billable that never got logged, matched to its matter, with a draft entry for each.

An hour-long call on the calendar with no matching activity in Clio is a billing gap, and it stays invisible unless somebody goes looking. The agent has both halves — Clio’s activities plus your calendar and inbox natively — so the comparison just runs. For most firms this is the one that pays for the setup in month one.

Get briefed before you walk into the meeting

An hour before any meeting with someone outside the firm, pull the matter from Clio with its recent activity, find the last email thread with them, research the external attendees on the web, and email me a one-page brief.

This is the workflow that reads least like automation and most like having someone. It’s stitching together three sources you’d otherwise open in three tabs, and it arrives without being asked.

Those are examples, not a menu — the same shape runs against any of Clio’s writable resources, and Carly’s workflow templates show the non-legal versions of the same patterns. In practice she interviews you about your matters, your billing habits, and your connected tools, then builds them with you one at a time.

Connecting it: five clicks and one app

Clio is a built-in provider on Carly’s integrations page, so you don’t run the OAuth flow by hand or manage tokens yourself. The whole thing:

1. On carlyassistant.com/integrations, find Connect an API and click Choose a provider, then pick Clio. Carly fills in the endpoints for you.
2. Carly shows you a callback URL with a copy button. Copy it.
3. At developers.clio.com/apps, create a private app and paste that callback URL into Redirect URIs. Pick your permissions (details below).
4. Back in Carly, paste the app’s Client ID and Client Secret. Read access is always on; tick Write access if you want Carly writing to Clio.
5. Hit Save and connect. Clio shows its approval screen, you approve, and you land back on the integrations page with Clio connected.

There’s no authorization code to copy off a screen, no curl, and no refresh token for you to store — Carly runs the exchange and refreshes the token on its own from then on. The connection then shows up with Reconnect, Edit, Disconnect, and Delete next to it.

If you’d rather be walked through it, copy the prompt below into Carly and she’ll take you one step at a time, including the Clio-side permission choices that are easy to get wrong.

Walk me through connecting Clio Manage to you, one step at a time. Stop and wait
for me after each step.

You can't create my Clio app or click through my dashboard for me. For anything I
have to do in a browser, give me the exact page and the exact values, then wait
for me to come back.

1. Send me to carlyassistant.com/integrations, then "Connect an API" ->
   "Choose a provider" -> Clio. Have me copy the callback URL shown there and
   paste it back to you, so you can give it to me verbatim in the next step.

2. Send me to https://developers.clio.com/ to sign in with my Clio Manage login
   and create an app under Developer Apps with:
     Name: Carly
     Website URL: my own firm's website
     Redirect URIs: the callback URL from step 1, exactly as shown (one line)
     Accept the Developer Terms of Service
     Permissions: Read + Write on Users and Calendars at minimum; add Matters,
       Contacts, Tasks, Activities, Documents if you want me working on those.
   Remind me that permissions freeze once I authorize, so widening them later
   means going through authorization again.

3. Have me copy the Client ID and Client Secret off the app page into the Clio
   form still open on the integrations page, tick Write access if I want you
   writing to Clio, and hit "Save and connect". Ignore the secondary secret.
   Clio will show its approval screen and send me back. Wait for me to confirm.

4. Verify over the connection: GET
   https://app.clio.com/api/v4/users/who_am_i.json. Do NOT send an
   X-API-VERSION header — "latest" returns HTTP 410. Show me my Clio name and id.

5. Only once that returns my name, tell me I can start asking for real Clio work.

Two things change it: Clio’s EasyStart tier can’t create developer apps at all, and firms outside the US instance can’t use the Clio provider option, because it points at the US hosts. Both are covered below.

Doing it by hand instead

Clio Manage has a full REST API, and reaching it takes no partner program, no app review, and no sales call. You register a private app, run the OAuth flow once, and you have credentials an agent can use to read and write matters, contacts, calendars, tasks, and time entries.

Everything below is Clio Manage on the US instance. (Clio Grow is a separate API on separate hosts, over on the Clio Platform portal at developers.api.clio.com.)

If your firm is on another region, swap every domain for your own:

A token issued in one region is not valid against another, and apps don’t cross regions either — a firm operating in two of them needs a separate Clio account and a separate developer application in each.

This is the one case where the Clio provider option won’t work for you. Picking Clio from the provider list fills in the US hosts and doesn’t let you edit them. On another region, use Connect directly on the same form instead — the link sits right under the provider dropdown — and enter your region’s authorize URL, token URL, and API base URL by hand. Everything after that (client ID, secret, callback URL, Save and connect) is identical.

Create the private app

Go to developers.clio.com, sign in with your normal Clio Manage login, and open Developer Apps. There’s no separate developer signup to complete first; your Clio credentials are the login.

Private apps aren’t reviewed by Clio and can’t be listed in the App Directory. Other than that they’re built exactly like public ones: same OAuth flow, same API.

One plan gate to know about: Clio’s docs say apps and integrations, private ones included, aren’t available on the EasyStart tier. Any paid tier above it works.

The form asks for these:

The redirect URI is the field that trips people up. It has to point at whatever is going to catch the authorization code. If you’re connecting through Carly, that’s Carly — the integrations page shows you the exact callback URL with a copy button, so paste that. It looks like https://dashboard.carlyassistant.com/api/custom-oauth/callback/connection, but copy it from the page rather than typing it from here.

If you’re doing this by hand with no server of your own to redirect to, Clio publishes a special redirect for that case, https://app.clio.com/oauth/approval, which embeds the authorization code in both the URL and the page title so you can read it off the screen instead of catching it in code.

Either way, the form rejects localhost; it requires https or http://127.0.0.1. And whatever you enter must match byte for byte in both the authorize URL and the token exchange, trailing slash included. A mismatch returns a bare 400 invalid_grant with no explanation of what’s wrong, which makes it by far the most common way this fails.

Permissions are per-resource, each with a read-only or read/write choice. Grant what you actually want the agent touching. Users and Calendars are enough to prove the connection works, and Matters, Contacts, Tasks, Activities, and Documents are the ones worth adding for real work.

One thing to get right the first time: once a user authorizes your app, their granted permissions are frozen even across token refreshes. Widening scopes later means going through authorization again. Missing a scope shows up as 403 ForbiddenError, or more confusingly as associated records that come back with most fields stripped and a redacted: true flag rather than an error.

Running the OAuth flow yourself

Skip this section if you’re connecting through Carly — the provider option does all of it for you, and the only two values you ever handle are the client ID and secret. It’s here because it’s worth understanding what’s happening underneath, and because you need it if you’re wiring Clio into something you’re building yourself.

Clio only supports the authorization code grant. There is no client-credentials path and no “just issue me an API key” option; asking for one returns unsupported_grant_type. You do the browser flow once and keep the refresh token.

Client ID and secret appear on the app’s page in the portal as soon as you create it. Clio also shows a secondary secret, which is a spare for rotation and isn’t needed here.

Authorization code. Open this in a browser, swapping in your client ID:

https://app.clio.com/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.clio.com%2Foauth%2Fapproval

Approve, and the code lands in the address bar as code=... and in the page title as Success code=.... It’s valid for 10 minutes, so do the next step right away.

Refresh token. Exchange the code:

curl https://app.clio.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=THE_CODE" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "redirect_uri=https://app.clio.com/oauth/approval"

The response carries access_token, expires_in: 2592000, and refresh_token. That’s a 30-day access token, and per Clio’s docs the refresh token does not expire, which is why this is a one-time setup. Store it like a password; it’s a permanent key to firm data. It dies only if the user revokes the app from inside Clio Manage, which kills both tokens at once.

Where the credentials live in Carly

Carly treats Clio as a first-class connected API rather than a pile of loose secrets. The client ID and secret you paste are stored encrypted, and Carly’s own code never sees them — the credential is attached to the outbound request outside the sandbox the agent runs in. The access and refresh tokens Clio issues are held and rotated by Carly, so there’s nothing for you to save, name, or paste into a preferences note.

That’s the practical difference from the old bring-your-own-key setup: you’re not storing CLIO_REFRESH_TOKEN anywhere, and you don’t need a preferences line telling the agent how to mint an access token. Ask for Clio work and the connection is simply there.

One thing worth knowing anyway, because it explains a confusing error: don’t send an X-API-VERSION header. Clio’s v4 API accepts versioned and unversioned requests, and an unversioned request is served by the current default version. Send an invalid or deprecated version and you get 410 GONE, which is exactly what a hardcoded X-API-VERSION: latest produces, because latest isn’t a version. If you later want version pinning, pin to a real version number and plan to update it; Clio gives 90 days’ notice before a default changes and supports old versions at least a year.

Check that it worked

Ask the agent to GET https://app.clio.com/api/v4/users/who_am_i.json. It’s the cheapest possible authenticated request, so if it returns your name and ID, every part of the chain works: app config, redirect match, secrets, and token exchange. Anything that fails after that is a scope problem, not a setup problem.

Rate limits and what they mean for how you automate

50 requests per minute per access token during peak hours. Limits rise off-peak by an amount that varies per region, and peak is defined as 04:00–19:00 Pacific weekdays for US and Canada, 07:00–22:00 GMT for the EU, and 06:00–21:00 AET for Australia.

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset, and a 429 includes Retry-After. Clio explicitly says limits can change without notice and that you should read the headers rather than hardcode the number. There are no custom increases; Clio doesn’t grant them.

Fifty a minute is comfortable for event-driven work: a matter update, a time entry, a contact lookup. It’s tight for bulk operations, so a nightly full sync of a large matter list is the shape to avoid.

There’s also no sandbox. Clio doesn’t run a separate test environment, so you’re developing against a real account, either a 7-day trial or your firm’s live data.

Why a general assistant can’t run the workflows above

Every workflow at the top of this page starts with something happening: an email lands, a week ends, a matter changes status. Handing that to a general AI assistant hits a specific wall.

Both ChatGPT Scheduled Tasks and Claude Cowork can do unattended work on a timer. Neither ordinary scheduler is a general webhook or business-app event listener. ChatGPT Workspace Agents accept API triggers, but only after an upstream service notices the event.

“Summarize the Ramirez matter” is well inside what ChatGPT or Claude will do with Clio data you paste in. “Log the time entry the moment the client call ends” is not, because nothing is watching for the call to end.

That’s the half Carly is built for. It fires on the event, then runs the whole sequence: read the matter, draft the email, send it, write the time entry back to Clio. Because it also handles your inbox and calendar natively, updating Clio is one step inside a workflow rather than an isolated action.

Clio does ship AI of its own, now called Manage AI (it replaced Clio Duo). It drafts communications, summarizes matters, helps with billing, and turns scheduling orders into calendar events, all inside Clio Manage. That’s useful, and it’s a different job from this one: it works on Clio data within Clio, not across the inbox, calendar, and other tools where most of the trigger actually originates.

AI agents start at $35/month, and workflow steps that don’t use AI run free.

Frequently Asked Questions

Do I need a paid Clio plan to use the API?

Yes. Clio’s docs state that apps and integrations, including private apps, aren’t available on the EasyStart tier, and that you need a paid account to create apps and get a key and secret. There’s a 7-day free trial that works for testing.

How do I get a Clio API key?

Sign in at developers.clio.com with your Clio Manage login, open Developer Apps, and create an application. The Client ID and Client Secret appear on the app’s page. Those two values are all you paste into Carly; if you’re integrating by hand instead, you also need a refresh token, which comes from running the OAuth authorization flow once.

Is Clio’s Manage AI the same as connecting Clio to an AI agent?

No. Manage AI, which replaced Clio Duo, works on Clio data inside Clio Manage. Connecting the API to an outside agent lets that agent act on Clio alongside your email, calendar, and other tools, and start work from events that happen outside Clio.

Is the Clio Grow API the same as the Clio Manage API?

No. Clio Grow uses the Clio Platform API, with its own developer portal at developers.api.clio.com, API host at api.clio.com, and OAuth host at auth.api.clio.com. Clio Manage uses developers.clio.com and app.clio.com/api/v4. Credentials and endpoints don’t carry across.

Can I use Clio’s API without OAuth?

No. Clio supports only the authorization code grant. There’s no client-credentials flow and no static API key; attempting grant_type=client_credentials returns unsupported_grant_type. You do the browser authorization once and store the refresh token.

Does the Clio refresh token expire?

No. Clio’s documentation states that refresh tokens do not expire, which is why setup is one-time. Access tokens last 30 days. A refresh token stops working only if the user revokes the app from within Clio Manage, which deauthorizes both tokens.

What redirect URI should I use if I don’t have a server?

If you’re connecting Clio through Carly, use the callback URL Carly shows you on the integrations page when you pick Clio from the provider list — copy it with the button rather than typing it. If you’re doing the flow by hand with nothing to redirect to, use https://app.clio.com/oauth/approval, Clio’s published redirect for desktop and mobile apps; the authorization code appears in the URL and in the page title, so you read it off the screen. Clio rejects localhost but accepts http://127.0.0.1.

Do I have to store a Clio refresh token to use Carly?

No. Connecting Clio through the provider option on the integrations page means Carly runs the token exchange and refreshes access tokens itself. You paste only the client ID and secret from your Clio app. Storing CLIO_CLIENT_ID, CLIO_CLIENT_SECRET, and CLIO_REFRESH_TOKEN as individual API keys was the older setup and is no longer necessary.

What is the Clio API rate limit?

50 requests per minute per access token during peak hours, higher off-peak by a region-dependent amount. Responses include X-RateLimit-* headers, 429s include Retry-After, and Clio doesn’t grant custom increases.

Why am I getting a 400 invalid_grant from Clio?

Usually the redirect_uri in your token exchange doesn’t match the one registered on the app and used in the authorize URL. The match is exact, including trailing slashes. The other common cause is an expired authorization code, which is only valid for 10 minutes.

Why is my Clio request returning 410 GONE?

You’re sending an X-API-VERSION header with a value Clio doesn’t recognize. latest isn’t a valid version, and deprecated versions return 410 too. Omit the header to use the current default version, or pin to a real version number.

More: Best Clio integrations · How to connect Claude to Clio · Best AI tools for law firms

Related Articles

Guides

18 Best AI Tools for Lawyers [2026]

Jan 29, 2026

Guides

Clio vs MyCase: 2026 Pricing for Small Law Firms

Jul 28, 2026

Guides

How Law Firms Use AI Agents to Manage Clients and Recover Billable Hours

Mar 16, 2026