Miro
Connect Miro to manage boards and sharing, and create sticky notes, shapes, text, cards, frames, and connectors.
You end up pasting the Client ID and Client secret of a Miro app you create in your own Developer team.
- Setup time
- 6 min
- Auth
- OAuth authorization
- API base URL
- https://api.miro.com/v2
- Rate limits
- Credit-based and applied per user per app. A global ceiling of 100,000 credits per minute, with calls costing 50 credits (Level 1, 2,000 per minute), 100 credits (Level 2, 1,000 per minute), 500 credits (Level 3, 200 per minute) or 2,000 credits (Level 4, 50 per minute).
Before you begin
- A Miro account. The Free plan is enough to create an app.
- A Developer team. Miro creates one at no cost the first time you build an app.
- An Enterprise plan if you need the organizations:read and organizations:teams:read scopes
- PopMCP's callback URL copied, ready to paste as the app's redirect URI
Get your credentials
Open Your apps
Click your avatar in the top right, choose Settings, then open the Your apps tab. Click + Create new app.
Name the app and enable expiring tokens
In the Create new app modal, type PopMCP in App name and tick Expire user authorization token. Click Create app.
Your apps
Apps you have built, grouped by Developer team.
Add the redirect URI
On the app settings page, scroll to Redirect URI for OAuth2.0, paste PopMCP's callback URL and click Add. The URI must match what PopMCP sends, character for character.
PopMCP
Acme Dev team
| Redirect URI | Options |
|---|---|
| https://app.popmcp.com/oauth/callback/miro | Default |
Tick the permission scopes
Scroll to Permissions and tick boards:read, boards:write, identity:read and team:read. Leave the organizations:* boxes clear unless your account is on Enterprise.
PopMCP
Users see this scope list on the consent screen when they connect.
Copy the Client ID and Client secret
Open App Credentials on the same page and copy Client ID and Client secret into the matching PopMCP fields. Save, then run the connect flow.
PopMCP
- Client ID
- 3458764591****2077
- Client secret
- kQ8xN2****d51f
- App ID
- 3074457360****8815
Both values stay readable on this page, so you can come back for them.
Connect in PopMCP
Open your workspace, choose Miro in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Auth typepreset | Create an app at miro.com/app/settings → "Create new app". Keep "Expiring token" enabled (the default) so access refreshes automatically, and enable the boards:read + boards:write scopes (plus organizations/teams scopes for Enterprise admin). |
| Client IDtext | Your app's "Client ID" from its App settings page on miro.com. |
| Client secretsecret | Your app's "Client secret" from its App settings page. Stored encrypted; used server-side only and never shown again.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/miro/callbackAdd this exact URL to your Miro app's "Redirect URI for OAuth2.0" (App settings → Permissions / Redirect URIs at miro.com/app/settings). It must match exactly, or Miro rejects the authorization.
PopMCP verifies the credential against Miro immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Miro at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| boards:read | Retrieve information about boards, board members and items. Every read tool depends on it. |
| boards:write | Create, update or delete boards, members and items: sticky notes, shapes, text, cards, frames and connectors. |
| identity:read | Reads the connected user's profile, including email, so PopMCP can show whose account is attached. |
| team:read | Reads current team information, needed to list the teams a board can belong to. |
| team:write | Required by the tools this connector exposes. |
| organizations:read | Organisation name, plan, licences, settings and members. Enterprise plans only, so leave it off otherwise or authorisation fails. |
| organizations:teams:read | Required by the tools this connector exposes. |
Verify it worked
After the OAuth redirect completes, PopMCP shows the Miro connector as Connected with your Miro name attached, and asking it to list boards returns the boards in your team.
Troubleshooting
redirect_uri_mismatch during the connect flow
Why: The redirect URI on the Miro app does not exactly match the callback URL PopMCP sends.
Fix: Re-copy PopMCP's callback URL and add it verbatim under Redirect URI for OAuth2.0. Scheme, host, path and any trailing slash all have to match.
The connection stops working after about an hour
Why: The app was created without Expire user authorization token ticked, so Miro never issued a refresh token.
Fix: That checkbox is fixed at creation time and cannot be edited afterwards. Create a new app with it ticked, move the redirect URI and scopes over, then reconnect.
Authorisation fails when organizations scopes are requested
Why: The organizations:read and organizations:teams:read scopes are Enterprise only.
Fix: Untick those scopes under Permissions unless your Miro account is on Enterprise, then reconnect.
The app does not appear in your normal team
Why: Apps are created inside a Developer team, which is separate from your working team.
Fix: Install the app to the team whose boards you want to reach using Install app and get OAuth token.
429 Too Many Requests on bulk board edits
Why: The app hit Miro's per-minute credit ceiling.
Fix: Slow the run down and batch item creation. Creating or updating an item is a Level 2 call at 100 credits and 1,000 per minute, and deleting one is Level 3 at 500 credits and 200 per minute.