Creating an OAuth app

Create an OAuth app to access Calendly data on behalf of other Calendly users. Then use the OAuth authorization code flow with PKCE to get an access token for each user.

Create your OAuth app

1. Log in to Calendly, or sign up for a Calendly account.

2. Open Developer tools. In Calendly, open the Profile menu and select Developer.

   Don’t see Developer in your Profile menu? Your account is still being moved. Until then, manage OAuth apps at developer.calendly.com.

3. On the OAuth apps tab, select Create OAuth app.

4. Enter the app details:

   • App name: use letters, numbers, hyphens, and spaces only.
   • Redirect URI: the URL where Calendly sends users after they authorize your app. Enter exactly one URI.
   • Environment type: select Sandbox for development and testing, or Production when your app is ready for real users.

5. Select Next.

6. Select the scopes that your app needs. Select at least one scope. Learn more about scopes.

7. Select Create.

Redirect URI rules

We recommend that you start with a Sandbox app for development. Create a second app for Production when you are ready to use real customer data.

Save your credentials

After you create the app, Calendly shows these values:

• Client ID: your app’s identifier. Send it in each OAuth request.
• Client secret: a secret that your server uses to authenticate with Calendly.
• Webhook signing key: a key that you use to verify webhook signatures.

Authorize users with PKCE

Every OAuth app must use Proof Key for Code Exchange (PKCE) with the S256 method. If the authorization request does not include a code challenge, the request fails. For more information about PKCE, see this guide. For a JavaScript example, see pkce-vanilla-js.

Get an authorization code

1. Generate a CODE_VERIFIER.
2. Build a CODE_CHALLENGE from the verifier with SHA-256.
3. Redirect the user to Calendly’s authorization page in a web browser. Replace CLIENT_ID, REDIRECT_URI, and CODE_CHALLENGE with your values.

https://auth.calendly.com/oauth/authorize?client_id=CLIENT_ID
&response_type=code
&redirect_uri=REDIRECT_URI
&code_challenge_method=S256
&code_challenge=CODE_CHALLENGE

After the user grants access, Calendly redirects the user to your redirect URI with the authorization code:

REDIRECT_URI?code=f04281d639d8248435378b0365de7bd1f53bf452eda187d5f1e07ae7f04546d6

Exchange the code for an access token

Send a POST request to Get Access Token at https://auth.calendly.com/oauth/token. Include these parameters:

• grant_type: authorization_code
• code: the authorization code
• redirect_uri: the same redirect URI that you used to get the code
• client_id: your client ID
• code_verifier: the verifier that you generated in step 1

If your app runs on a server, also send your client secret. Use HTTP Basic authentication with your client ID as the username and your client secret as the password.

Edit your OAuth app

1. Open Developer tools.
2. Select the pencil icon next to the app.
3. Change the app name, redirect URI, environment type, or scopes.
4. Save your changes.

You cannot view the client secret or the webhook signing key when you edit an app.

Delete your OAuth app

1. Open Developer tools.
2. Select the trash icon next to the app.
3. Select Delete to confirm. You cannot undo this action.

See more

Learn what else you can accomplish with the Calendly API.

For the conditions that cause an access token to be revoked, see the Frequently Asked Questions.