Get Access Token | Calendly | Developer Documentation

const url = 'https://auth.calendly.com/oauth/token';
const credentials = btoa("<username>:<password>");
const options = {
  method: 'POST',
  headers: {
    Authorization: `Basic ${credentials}`,
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams('')
};
try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGguY2FsZW5kbHkuY29tIiwiaWF0IjoxNjMxNzI3Nzk5LCJqdGkiOiI5ZmViM2I0Zi04Njk1LTQzZjgtYWJhMS1kNDRiM2I5ZDdjYzEiLCJ1c2VyX3V1aWQiOiJCR0hIREdGREdIQURCSEoyIiwiYXBwX3VpZCI6IkppNzY5UjZ6eTZzSVN4X3I0OWRmZ0VsN0NPazVmeFVadVA0eHBadFlPbUkiLCJleHAiOjE2MzE3MzQ5OTl9.CrVBOFsqLjyfPK2E834E3sJv3fKU-PPlaNXQQB80Deo",
  "refresh_token": "b77a76ffce83d3bc20531ddfa76704e584f0ee963f6041b8bfc70c91373267d5",
  "created_at": 1548689183,
  "expires_in": 7200,
  "owner": "https://api.calendly.com/users/EBHAAFHDCAEQTSEZ",
  "organization": "https://api.calendly.com/organizations/EBHAAFHDCAEQTSEZ",
  "scope": "default"
}

Use Access Tokens to access Calendly resources on behalf of an authenticated user.

To make a call to this endpoint:

Include client_id as a body parameter.
For the authorization_code grant, include the code_verifier that matches the code_challenge you sent to the authorization endpoint.
If your app runs on a server, also pass client_id and client_secret with the Basic HTTP Authorization header.

Note:

Access Tokens expire after 2 hours.
Refresh Tokens don’t expire until they are used.
Only 8 oauth tokens per user can be requested within a span of 1 minute

Authentication

AuthorizationBasic

Use client_id for username and client_secret for password.

Request

This endpoint expects an object.

Web Token Request with Authorization CodeobjectRequired

The Authorization Code token request for web apps.

Web Token Request with Refresh TokenobjectRequired

The Refresh Token request for a token for web apps.

Native Token Request with Code VerifierobjectRequired

Native Token Request with Refresh TokenobjectRequired

The Refresh Token request for a token for native apps.

Response

token_typeenum

The token type (currently this is always “Bearer”)

Allowed values:

access_tokenstring

The access token provided in the response

refresh_tokenstring

The refresh token provided in the response

created_atdouble

The UNIX timestamp in seconds when the event was created

expires_indouble

The number of seconds until the access token expires

ownerstringformat: "uri"

A link to the resource that owns the token (currently, this is always a user)

organizationstringformat: "uri"

A link to the owner's current organization

scopestringOptional

The scope of the access request

Errors

400

Bad Request Error

401

Unauthorized Error

429

Too Many Requests Error