Skip to navigation
API ReferenceOAuth

Get Authorization Code

The Authorization Code is a temporary code that your client exchanges for an access token. While this flow is supported, we recommend using the PKCE flow for all OAuth applications.

Web applications

To receive user’s Access Token, have your app redirect the user to Calendly’s authorization page with the client_id and redirect_uri replaced with your application’s client_id and redirect_uri (see example below). Note that this url must be requested using a web browser.

https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=https://my.site.com/auth/calendly

When a user grants access, their browser is redirected to the specified redirect_uri, the Authorization Code is passed inside the code query parameter:

https://my.site.com/auth/calendly?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6

The flow for mobile or native applications requires PKCE conforming to the RFC 7636 specification. This flow is also recommended for web apps to mitigate against authorization code injection. For more information, see this guide. An example of a javascript implementation can be found here.

To receive an Authorization Code:

  • Generate a CODE_VERIFIER
  • Build a CODE_CHALLENGE
  • Redirect the user to Calendly’s authorization page with the client_id, redirect_uri, and code_challenge replaced with your application’s client_id, redirect_uri, and the code_challenge generated in the step above (see example below). Note that this url must be requested using a web browser.
https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=com.site.app://auth/calendly&code_challenge_method=S256&code_challenge=CODE_CHALLENGE

After the user grants access, they will be redirected back to your app with the Authorization Code:

com.site.app://auth/calendly?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6

Query parameters

client_idstringRequired
The ID provided by Calendly for the web application
response_typeenumRequired

The response type (which is always “code”)

Allowed values:
redirect_uristringRequired
The redirect URI for your OAuth application
code_challenge_methodstringRequired
The method used for native clients
code_challengestringRequired
Use a code challenge for native clients

Response

OK