Calendly
Calendly OAuth is self-serve. You create Sandbox and Production apps in the Developer page, PKCE (S256) is mandatory, and no app review is documented, so your own account can connect in about 30 minutes and launch can follow within days. The main catches are legal and plan-related: the Developer Policy may require Calendly's written consent before you send invitee data to an LLM sub-processor, and webhooks only work for clinics on paid Calendly plans.
Review: No app review is documented. Production is a self-serve environment setting.
Timing: There is no documented review, so the range depends mainly on how long Calendly takes to reply to a written-consent request for LLM sub-processing and on updating your privacy policy.
Cost: There is no developer fee. Webhooks need the connecting clinic to have a paid Standard, Teams or Enterprise plan, and activity log and data-compliance endpoints are Enterprise-only.
Before you start
- for buildCalendly user account with access to the Developer page (calendly.com/app/developer)sourceds1s2
- for buildOne redirect URI per app: localhost for the Sandbox app, https for the Production app✓ Iskaria has itsourceds1
- for buildApp name using only letters, numbers, hyphens and spaces (Iskaria qualifies)✓ Iskaria has itsourceds1
- for launchIndustry-standard privacy policy that covers Calendly data and AI processing✓ Iskaria has itsourceds10
- for launchEncryption of stored Calendly data (Iskaria encrypts tokens per tenant)✓ Iskaria has itsourceds10
- for launchCustomer support info shown in the app. Your profile has no shared support mailbox; a personal address works but is fragile.✗ missing in profileinferreds10
- for launchCalendly's written consent if invitee data goes to LLM sub-processors✓ Iskaria has itinferreds10
Who does what
- Implement the PKCE auth code flow, refresh-token rotation and reconnect handling
- Pick the scopes and handle 403s from declined scopes
- Draft the privacy policy section and the consent email to Calendly
- Build rate-limit (429) handling
- Log in to Calendly and create the Sandbox and Production apps
- Save the one-time credentials
- Send the sub-processor consent request and keep the reply
- Approve the privacy policy changes
Steps
Log in to Calendly, then go to Profile menu → Developer → OAuth apps. If your account has not been migrated yet, use developer.calendly.com/login instead.
https://calendly.com/app/developerClick Create OAuth app. Enter the app name Iskaria, set Environment type to Sandbox, set the redirect URI to http://localhost:3000/api/oauth/calendly/callback, and select the scopes listed below.
https://calendly.com/app/developerApp name Iskaria Redirect URI ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"]Exactly one URI: http://localhost:3000/api/oauth/calendly/callback Environment type Sandbox Scopes {"google":"Read Search Console, GA4 and Business Profile data for a clinic's own properties (webmasters.readonly, analytics.readonly, business.manage)","gmail":"Draft and send patient follow-up emails from the clinic's mailbox","meta":"Reply to WhatsApp, Instagram and Messenger messages for a clinic; publish the clinic's own posts","slack":"Post lead alerts and daily summaries into the clinic team's Slack","github":"Developer tooling: open issues/PRs from voice-note tasks","hubspot":"Sync leads and bookings into the clinic's CRM","default":"Let the clinic's AI assistant read and act on the clinic's own data in this app"} The client ID, client secret and webhook signing key are shown only once. Copy all three straight into your secret store.
Use the documented auth.calendly.com endpoints and allow the 301 redirect to calendly.com/oauth/*. Always send a code_challenge (S256). At the token endpoint, send the code_verifier plus HTTP Basic auth (client_id as username, secret as password). Access tokens last 2 hours. Refresh tokens are single-use, so store the new one on every refresh. Build a reconnect flow for invalid_grant and for tokens revoked by password or login changes. Handle 403s from declined scopes.
Connect through the Sandbox app. Call GET /users/me, list scheduled events, and create a webhook (this needs a paid plan). Watch the per-user rate limits.
- 6Draft the privacy policy section and the sub-processor consent requestAgent drafts, you submit1 hinferreds10
Add a Calendly section to iskaria.com/privacy that covers AI processing. Draft an email to support+developer@calendly.com asking for written consent for LLM sub-processing, and keep the reply.
Create a second app with Environment type set to Production and the redirect URI https://app.iskaria.com/api/oauth/calendly/callback (https only). Use the same scopes and save the new credentials.
https://calendly.com/app/developerRedirect URI ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"]https://app.iskaria.com/api/oauth/calendly/callback Environment type Production
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| users:read | Get the owner and organization URIs via GET /users/me | basic | sourceds3 |
| event_types:read | List the clinic's bookable services | basic | sourceds3 |
| availability:read | Answer availability questions from patients | basic | sourceds3 |
| scheduled_events:write | Book via POST /invitees, cancel bookings and mark no-shows (includes read access) Booking through the API has extra limits on the Create Event Invitee endpoint. | basic | sourceds3s4 |
| scheduling_links:write | Create one-off booking links | basic | sourceds3 |
| routing_forms:read | Read lead intake forms | basic | sourceds3 |
| contacts:write | Sync leads (includes read access) | basic | sourceds3 |
| webhooks:write | Real-time lead and booking alerts The clinic needs a paid Calendly plan, and the matching read scopes must also be granted. | paid | sourceds3s7 |
| organizations:read | Support multi-practitioner clinics | basic | sourceds3 |
What can slow you down or block approval
The Developer Policy forbids subcontracting data processing to a third-party sub-processor without Calendly's prior written consent. Sending invitee data to an LLM vendor may count.
Workaround: Email support+developer@calendly.com before launch and keep the written reply.
Clinics on the Free plan cannot get webhook subscriptions. Free plans are also limited to 50 requests/min per user, versus 500/min on paid plans.
Workaround: Poll scheduled events for clinics on the Free plan.
The client secret, signing key and (currently) the client ID cannot be viewed again after creation.
Workaround: Save them to your secret store immediately.
Tokens are revoked when a user changes their password, login email or login method. Refresh tokens are single-use, and reusing an old one returns invalid_grant.
Workaround: Build a reconnect flow and store the rotated refresh token atomically.
The probe found registration_endpoint https://calendly.com/oauth/register with public clients and S256 only. This is the Calendly MCP server path (mcp.calendly.com), where an agent may be able to register a client itself with no manual app. It is not available for the REST API, and it only offers the coarse scopes mcp:scheduling:read and mcp:scheduling:write, with no webhooks.
Workaround: Use the console-created app for REST and webhooks.
The policy requires support info in your app, and your profile's sharedSupportMailbox is null.
Workaround: Create a support@iskaria.com mailbox.
Patient booking data is health-related, and whether a BAA or Calendly's health-data terms apply was not checked.
What we checked
| Claim | How | Result |
|---|---|---|
| No review gate for production Consistent absence; never stated outright. | Checked 4 official pages (creating-an-oauth-app, legacy developer account page, Developer Policy, FAQ) | unverified |
| Access token lifetime is 2 hours Single source. | Token endpoint reference; FAQ is silent | unverified |
| 8 token requests per user per minute; 500/50 per-user request limits | Rate-limits page and token endpoint reference agree | confirmed |
| PKCE required for all apps The current official doc makes PKCE mandatory; always send it. | Official creating-an-oauth-app page vs older text quoted by unified.to | corrected |
| Scopes required for new apps since 2026-03-03 | Changelog entry and scopes page | confirmed |
| One redirect URI per app; Sandbox allows localhost | New and legacy registration pages | confirmed |
| Dynamic client registration endpoint exists | probe_oauth of /.well-known/oauth-authorization-server on calendly.com | confirmed |
- The absence of a review gate is inferred, never stated outright.
- Whether LLM inference counts as sub-processing that needs written consent.
- Whether org-wide queries need an admin or owner role.
- How an unknown client is rejected at the authorize endpoint (the probe did not follow the 301).
- The 2-hour token lifetime rests on a single page.
- BAA and health-data terms were not analysed.
- The 2026-04-15 rate-limit change for Create Event Invitee was not read in full.
Sources
- s1Creating an OAuth app · official-docs · accessed 2026-10-30
“Every OAuth app must use Proof Key for Code Exchange (PKCE) with the S256 method.”
- s2Create a developer account (legacy) · official-docs · accessed 2026-10-30
- s3Authorization Scopes · official-docs · accessed 2026-10-30
“no API access is granted until scopes are explicitly requested and approved”
- s4Rate Limits · official-docs · accessed 2026-10-30
“Only 8 OAuth tokens per user can be requested within a span of 1 minute.”
- s5
- s6Refresh token rotation guide · official-docs · accessed 2026-10-30
- s7FAQ · official-docs · accessed 2026-10-30
“the Calendly user account for which the webhook subscription is being made will need a paid subscription”
- s8Calendly MCP Overview · official-docs · accessed 2026-10-30
“you do not need to pre-register an OAuth application”
- s9Changelog · official-docs · accessed 2026-10-30
- s10Developer Policy · provider-policy · accessed 2026-10-30
“All Developers must have an industry standard privacy policy in place that accurately describes the specifics of data usage”
- s11Calendly Partner Program listing · community · accessed 2026-10-30
“New partners apply through the Calendly partner portal”
- s12Calendly OAuth app skill (unified.to) · community · accessed 2026-10-30
- s13Changelog 2026-03-03 (scopes launch) · official-docs · accessed 2026-10-30
- s14probe_oauth: calendly.com OAuth discovery and authorize test · our-test · accessed 2026-10-30
“registration_endpoint https://calendly.com/oauth/register”