# How to Send a ClickUp Status Alert to Your Team's Phones

> Use a ClickUp Automation webhook, a small privacy-minimizing relay, and a PingRoom incoming webhook to share one selected task status with a Room.

- Published: 2026-10-22
- Author: PingRoom
- Category: Developers
- Topics: ClickUp push notification, ClickUp status change alert, ClickUp automation webhook
- Canonical: https://pingroom.io/blog/clickup-status-change-push-notifications
- Cover image: https://pingroom.io/blog/clickup-status-change-push-notifications-cover.webp
- Cover description: Two PingRoom avatars move a plain task tile into a warm ivory review tray while Pingo watches from the project table.

**To send one ClickUp task status to a shared group of phones, create an Automation for a precise status such as _Ready for review_, send its webhook to a small trusted relay, and let the relay post one fixed message to a PingRoom incoming webhook.** Keep the task name, description, assignees, and full ClickUp payload out of the phone alert.

This is a webhook recipe, not a native ClickUp integration. It is useful when one milestone should reach a small Room that includes people who do not spend their day in ClickUp.

## Start with ClickUp's own notifications

ClickUp already sends mobile push notifications. Its [mobile-notification guide](https://help.clickup.com/hc/en-us/articles/6327489671063-Mobile-notifications) says they are available on all plans, including for guests, and each person can choose a default, focused, mentions-only, custom, or disabled setup.

Use that route when the recipients already work in ClickUp and need the task context there.

| Need                                                                          | Better starting point                                      |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------- |
| Assigned people and watchers need normal task context                         | ClickUp mobile notifications                               |
| One selected milestone should reach a separate shared attention channel       | ClickUp Automation webhook → trusted relay → PingRoom Room |
| The alert needs task fields, conditional routing, queuing, or a durable audit | A reviewed integration service or application-owned relay  |
| The event is urgent, safety-critical, or regulated                            | The approved pager, record, and escalation path            |

A Ping is an attention signal. It does not approve the task or prove that review happened. ClickUp remains the record.

## Why the webhook should stop at a relay

ClickUp's [Automation webhook guide](https://help.clickup.com/hc/en-us/articles/35313844961943-Integrate-ClickUp-using-Automation-webhooks) lets an Automation send task data when chosen triggers and conditions match. It also supports headers, URL parameters, dynamic URL variables, and a test step. Feature availability and limits vary by plan and user role, so confirm that **Call webhook** is available before building.

The [documented Call webhook payload](https://developer.clickup.com/docs/automationwebhookpayload) is broad. It can include a task name, content, workspace and list identifiers, user identifiers, dates, tags, fields, and other task metadata.

Do not point that payload straight at a lock-screen notification service merely because both ends speak HTTP. Put a relay between them. The relay can verify a separate source secret, derive a stable event identity, discard the task object, and forward only the sentence people need.

## Create the destination Room and webhook

Create a private PingRoom Room for the people who need the review signal. The Room owner needs **PingRoom Pro** for incoming webhooks.

In the PingRoom browser app, open the Room's **Settings → Connections → From another app**, add an incoming webhook, and copy its full URL into protected relay configuration. The URL contains the PingRoom secret. Do not place it in the ClickUp Automation, a task field, source control, or client-side code.

The [incoming-webhook guide](/blog/webhook-to-push-notification) explains the response and Room outcome. The [webhook reference](/documents/webhooks) carries the current request limits, cooldown behavior, and error responses.

Use fixed copy for the first version:

- Title: **Ready for review**
- Message: **One ClickUp task is ready. Open ClickUp for details.**

That copy is useful without putting a client name, task title, assignee, link, or private project detail on a lock screen.

## Add the privacy-minimizing relay

Run this handler in a trusted server-side function or service that receives HTTPS requests. Store both secrets in server-side environment variables.

```js
import crypto from "node:crypto";

export async function handleClickUp(request, env) {
  const sourceKey = request.headers.get("x-clickup-relay-key") ?? "";
  if (!safeEqual(sourceKey, env.CLICKUP_RELAY_KEY)) {
    return Response.json({ error: "unauthorized" }, { status: 401 });
  }

  const raw = await request.text();
  if (Buffer.byteLength(raw) > 256_000) {
    return Response.json({ error: "payload_too_large" }, { status: 413 });
  }

  let event;
  try {
    event = JSON.parse(raw);
  } catch {
    return Response.json({ error: "invalid_json" }, { status: 400 });
  }

  const { auto_id: automationId, trigger_id: triggerId, date } = event;
  if (
    ![automationId, triggerId, date].every((value) => typeof value === "string")
  ) {
    return Response.json({ error: "invalid_event" }, { status: 422 });
  }

  const eventKey = crypto
    .createHash("sha256")
    .update(`${automationId}\n${triggerId}\n${date}`)
    .digest("hex");

  const ping = {
    title: "Ready for review",
    message: "One ClickUp task is ready. Open ClickUp for details.",
    correlation_id: `clickup:${eventKey}`,
  };

  const response = await fetch(env.PINGROOM_WEBHOOK_URL, {
    method: "POST",
    headers: {
      Accept: "application/json",
      "Content-Type": "application/json",
      "Idempotency-Key": `clickup-${eventKey}`,
    },
    body: JSON.stringify(ping),
  });

  return new Response(await response.text(), {
    status: response.status,
    headers: { "Content-Type": "application/json" },
  });
}

function safeEqual(left, right) {
  const a = Buffer.from(left);
  const b = Buffer.from(right ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}
```

The relay reads only the three top-level fields needed to identify this delivery. It never copies `event.payload` into the PingRoom request. The task object can be discarded after validation.

The idempotency key comes from ClickUp's automation ID, trigger ID, and event date. An exact retry of the same ClickUp delivery produces the same key and the same PingRoom body. A later status event has a different date and therefore a different identity.

This is application code, not an AI judgment. The ClickUp condition decides when to call the relay; deterministic code verifies, minimizes, and sends the event.

## Build one precise ClickUp Automation

In the ClickUp location that owns the task state:

1. Create an Automation whose trigger is **Status changes**.
2. Set the target status to **Ready for review**.
3. Add any location or task-type condition needed to keep the rule narrow.
4. Add the **Call webhook** action and use your relay's HTTPS URL.
5. Add `X-ClickUp-Relay-Key` with the separate relay secret.
6. Use ClickUp's test step with a generic sample task before enabling the rule broadly.

Do not use the PingRoom webhook URL as the ClickUp destination. ClickUp editors need access only to the relay URL and relay key. The PingRoom secret stays one hop away.

![Two PingRoom avatars stand beside a narrow clay relay gate while one small signal token exits and Pingo watches the larger bundle left behind.](/blog/clickup-status-change-push-notifications-1.webp)

_These AI-generated editorial illustrations feature approved PingRoom avatars and Pingo the Pigeon, PingRoom's fictional Chief Marketing Officer. They are not ClickUp or PingRoom screenshots and do not depict customers._

[Pingo](/Pingo) is studying the larger bundle that did not pass through the relay. He has no ClickUp account, no access to a private Room, and no authority to change a task or send a Ping. The humans choose the rule, secrets, recipients, and copy.

## Test the boundary, not just the happy path

Use a dedicated test list or one generic sample task. ClickUp recommends narrow conditions and representative test data before connecting a webhook to real work.

Check these paths:

1. Move the sample task into **Ready for review** and confirm one Ping appears.
2. Replay the exact ClickUp event and confirm PingRoom returns the original accepted result instead of creating another Ping.
3. Send the wrong relay key and confirm the relay returns `401` without calling PingRoom.
4. Send malformed or oversized input and confirm it is rejected.
5. Change an unrelated field and confirm the status-specific Automation does not run.
6. Inspect the relay's outgoing request and confirm it contains no task name, description, assignee, user, list, or workspace metadata.
7. Rotate the relay key and PingRoom webhook secret separately, then confirm the old values stop working.

For this article, we ran a ClickUp-shaped fixture through the relay and a local mock of PingRoom's documented contract. The check covered a new event, exact replay, a same-key/different-body conflict, source-secret rejection, malformed and oversized input, and the absence of ClickUp task metadata in the outgoing body. It used no live ClickUp Workspace, PingRoom Room, or phone.

## Read failures without inventing task state

Return PingRoom's status to ClickUp so a failed destination remains visible as a failed webhook call. Keep the rule selective: a Room alert for every edit becomes another feed to ignore.

PingRoom applies webhook cooldown and rate limits. If several tasks can reach the status together, place a queue behind the relay or choose a digest/notification design that fits the burst. Do not drop requests and describe the result as complete coverage.

HTTP 200 from PingRoom means the event was accepted and queued through PingRoom's normal path. It does not guarantee what a particular phone showed under its current connectivity, Focus mode, notification permission, or Room settings.

Keep ClickUp's Automation activity and the task itself as the operational record. If the alert is missing, inspect those sources and the relay logs rather than treating Room silence as proof that no task changed state.

If one task milestone deserves a separate shared signal, [create the private Room and incoming webhook](/app/rooms), deploy the relay with generic test data, and keep the work details in ClickUp.

_ClickUp is a trademark of its owner. PingRoom is not affiliated with or endorsed by ClickUp._