Skip to navigation
API ReferenceOAuth

Get Authorization Code

The Authorization Code is a temporary code that your client exchanges for an access token.

PKCE flow (required)

Every OAuth app must use PKCE conforming to RFC 7636, with the S256 method. If the request does not include a code_challenge, it fails. For more information, see this guide. For a JavaScript example, see pkce-vanilla-js.

To receive an Authorization Code:

  • Generate a CODE_VERIFIER
  • Build a CODE_CHALLENGE
  • Redirect the user to Calendly’s authorization page with the client_id, redirect_uri, and code_challenge replaced with your application’s client_id, redirect_uri, and the code_challenge generated in the step above (see example below). Note that this url must be requested using a web browser.
https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=com.site.app://auth/calendly&code_challenge_method=S256&code_challenge=CODE_CHALLENGE

After the user grants access, they will be redirected back to your app with the Authorization Code:

com.site.app://auth/calendly?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6

Query parameters

client_idstringRequired
The ID provided by Calendly for the web application
response_typeenumRequired

The response type (which is always “code”)

Allowed values:
redirect_uristringRequired
The redirect URI for your OAuth application
code_challenge_methodstringRequired

The PKCE code challenge method. Use S256.

code_challengestringRequired

The PKCE code challenge, built from your code verifier with SHA-256. Required for every app.

Response

OK