> Calendly developer docs. For page Markdown, append .md to any URL.
> Index: https://developer.calendly.com/llms.txt
> API catalog: https://developer.calendly.com/.well-known/api-catalog
> OpenAPI: https://developer.calendly.com/openapi/calendly-api.yaml
> OAuth authorization server: https://calendly.com/.well-known/oauth-authorization-server
> MCP protected resource: https://mcp.calendly.com/.well-known/oauth-protected-resource
> Scheduling MCP endpoint: https://mcp.calendly.com
> Docs search MCP: https://developer.calendly.com/_mcp/server

# Get Authorization Code

GET https://auth.calendly.com/oauth/authorize

The **Authorization Code** is a temporary code that your client exchanges for an access token. While this flow is supported, we recommend using the PKCE flow for all OAuth applications.

## Web applications

To receive user's Access Token, have your app redirect the user to Calendly's authorization page with the `client_id` and `redirect_uri` replaced with your application's `client_id` and `redirect_uri` (see example below). Note that this url must be requested using a web browser.

```
https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=https://my.site.com/auth/calendly
```

When a user grants access, their browser is redirected to the specified `redirect_uri`, the Authorization Code is passed inside the `code` query parameter:

```
https://my.site.com/auth/calendly?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6
```

## PKCE Flow (recommended)

The flow for mobile or native applications requires PKCE conforming to the RFC 7636 specification. This flow is also recommended for web apps to mitigate against authorization code injection. For more information, see [this guide](https://oauth.net/2/pkce/). An example of a javascript implementation can be found [here](https://github.com/aaronpk/pkce-vanilla-js).

To receive an Authorization Code:

* Generate a `CODE_VERIFIER`
* Build a `CODE_CHALLENGE`
* Redirect the user to Calendly's authorization page with the `client_id`, `redirect_uri`, and `code_challenge` replaced with your application's `client_id`, `redirect_uri`, and the `code_challenge` generated in the step above (see example below). Note that this url must be requested using a web browser.

```
https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=com.site.app://auth/calendly&code_challenge_method=S256&code_challenge=CODE_CHALLENGE
```

After the user grants access, they will be redirected back to your app with the Authorization Code:

```
com.site.app://auth/calendly?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6
```

Reference: https://developer.calendly.com/api-docs/calendly-o-auth/o-auth/get-oauth-authorize

## Request

### Query parameters

- `client_id` (string, required) — The ID provided by Calendly for the web application
- `response_type` (enum, required) — The response type (which is always "code")
  - Allowed values: `code`
- `redirect_uri` (string, required) — The redirect URI for your OAuth application
- `code_challenge_method` (string, required) — The method used for native clients
- `code_challenge` (string, required) — Use a code challenge for native clients

## Response

### 200

OK

## Examples

**Response**

```json
{}
```

**SDK Code**

```python
import requests

url = "https://auth.calendly.com/oauth/authorize"

querystring = {"client_id":"client_id","code_challenge":"code_challenge","code_challenge_method":"S256","redirect_uri":"https://my.site.com/auth/calendly","response_type":"code"}

response = requests.get(url, params=querystring)

print(response.json())
```

```javascript
const url = 'https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code');

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code");
var request = new RestRequest(Method.GET);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let request = NSMutableURLRequest(url: NSURL(string: "https://auth.calendly.com/oauth/authorize?client_id=client_id&code_challenge=code_challenge&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmy.site.com%2Fauth%2Fcalendly&response_type=code")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```