Cal.com

Overview

Connect your users to Cal.com for open-source scheduling, appointment management, and availability tracking.

Property	Value
Provider ID	cal-com
Category	Productivity
PKCE	Not supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Cal.com OAuth Client

Go to Cal.com OAuth Settings

Navigate to Cal.com Settings > Developer > OAuth and sign in.

Create OAuth Client

Click Create OAuth Client.

Configure the client

Enter the client name, add the Alter callback URL (from the Developer Portal) under Redirect URIs (up to 10), and select at least one scope (e.g. BOOKING_READ, BOOKING_WRITE).

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Cal.com provider

Go to OAuth Providers > Add Provider > Cal.com.

Enter credentials

• Client ID: Paste your Cal.com Client ID
• Client Secret: Paste your Cal.com Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
BOOKING_READ	Read access to bookings
BOOKING_WRITE	Create, update, and cancel bookings
EVENT_TYPE_READ	Read access to event types
EVENT_TYPE_WRITE	Create and modify event types
SCHEDULE_READ	Read access to availability schedules
SCHEDULE_WRITE	Create and modify availability schedules
PROFILE_READ	Read access to user profile
PROFILE_WRITE	Update user profile
APPS_READ	Read access to installed Cal.com apps
APPS_WRITE	Install and configure Cal.com apps
WEBHOOK_READ	Read access to webhooks
WEBHOOK_WRITE	Create, edit, and delete webhooks
VERIFIED_RESOURCES_READ	View verified emails and phone numbers
VERIFIED_RESOURCES_WRITE	Request and verify emails and phone numbers
CREDITS_READ	View credit balance
CREDITS_WRITE	Charge credits
INSIGHTS_READ	View user insights

Notes

• Scopes use the RESOURCE_ACTION format (e.g. BOOKING_READ, BOOKING_WRITE) — not READ_BOOKING. The authorize endpoint accepts either space- or comma-separated scope lists.
• These are Cal.com’s user-level scopes. Cal.com also publishes TEAM_* and ORG_* scopes (for team- and organization-level endpoints) on the same OAuth client; those org-admin scopes are not offered here because this provider models a single-user connection.
• Cal.com Platform’s “managed users” system (/settings/platform/oauth-clients) is a different flow that uses an x-cal-secret-key header instead of the OAuth code exchange; it is not covered by this provider.
• Newly created OAuth clients start in pending status and require admin approval from the Cal.com team before they can be used.
• For most scheduling use cases, BOOKING_READ and SCHEDULE_READ provide sufficient access.
• Alter sends the token request as a JSON body; Cal.com’s token endpoint accepts both application/json and application/x-www-form-urlencoded.
• See the Cal.com OAuth documentation for more details on the flow, scopes, and available API endpoints.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
UserVerifiedResourcesController_requestEmailVerificationCode	admin, send	POST	/v2/verified-resources/emails/verification-code/request
UserVerifiedResourcesController_verifyEmail	admin, send	POST	/v2/verified-resources/emails/verification-code/verify
BookingAttendeesController_2024_08_13_removeAttendee	delete	DELETE	/v2/bookings/{bookingUid}/attendees/{attendeeId}
BookingsController_2024_08_13_cancelBooking	delete, write	POST	/v2/bookings/{bookingUid}/cancel
CalUnifiedCalendarsController_deleteCalendarEvent	delete	DELETE	/v2/calendars/{calendar}/events/{eventUid}
CalUnifiedCalendarsController_deleteConnectionEvent	delete	DELETE	/v2/calendars/connections/{connectionId}/events/{eventId}
CalendarsController_deleteCalendarCredentials	delete, write	POST	/v2/calendars/{calendar}/disconnect
ConferencingController_disconnect	delete	DELETE	/v2/conferencing/{app}/disconnect
EventTypeWebhooksController_deleteAllEventTypeWebhooks	admin, delete	DELETE	/v2/event-types/{eventTypeId}/webhooks
EventTypeWebhooksController_deleteEventTypeWebhook	admin, delete	DELETE	/v2/event-types/{eventTypeId}/webhooks/{webhookId}
EventTypesController_2024_06_14_deleteEventType	delete	DELETE	/v2/event-types/{eventTypeId}
EventTypesPrivateLinksController_deletePrivateLink	delete	DELETE	/v2/event-types/{eventTypeId}/private-links/{linkId}
OAuthClientUsersController_deleteUser	admin, delete	DELETE	/v2/oauth-clients/{clientId}/users/{userId}
OAuthClientWebhooksController_deleteAllOAuthClientWebhooks	admin, delete	DELETE	/v2/oauth-clients/{clientId}/webhooks
OAuthClientWebhooksController_deleteOAuthClientWebhook	admin, delete	DELETE	/v2/oauth-clients/{clientId}/webhooks/{webhookId}
OAuthClientsController_deleteOAuthClient	admin, delete	DELETE	/v2/oauth-clients/{clientId}
SchedulesController_2024_06_11_deleteSchedule	delete	DELETE	/v2/schedules/{scheduleId}
SelectedCalendarsController_deleteSelectedCalendar	delete	DELETE	/v2/selected-calendars
SlotsController_2024_09_04_deleteReservedSlot	delete	DELETE	/v2/slots/reservations/{uid}
WebhooksController_deleteWebhook	admin, delete	DELETE	/v2/webhooks/{webhookId}
BookingsController_2024_08_13_reassignBookingToUser	admin, write	POST	/v2/bookings/{bookingUid}/reassign/{userId}
EventTypeWebhooksController_createEventTypeWebhook	admin, write	POST	/v2/event-types/{eventTypeId}/webhooks
OAuthClientUsersController_createUser	admin, write	POST	/v2/oauth-clients/{clientId}/users
OAuthClientWebhooksController_createOAuthClientWebhook	admin, write	POST	/v2/oauth-clients/{clientId}/webhooks
OAuthClientsController_createOAuthClient	admin, write	POST	/v2/oauth-clients
WebhooksController_createWebhook	admin, write	POST	/v2/webhooks
BookingsController_2024_08_13_createBooking	write	POST	/v2/bookings
CalUnifiedCalendarsController_createCalendarEvent	write	POST	/v2/calendars/{calendar}/events
CalUnifiedCalendarsController_createConnectionEvent	write	POST	/v2/calendars/connections/{connectionId}/events
CalendarsController_createIcsFeed	write	POST	/v2/calendars/ics-feed/save
EventTypesController_2024_06_14_createEventType	write	POST	/v2/event-types
EventTypesPrivateLinksController_createPrivateLink	write	POST	/v2/event-types/{eventTypeId}/private-links
MeController_updateMe	write	PATCH	/v2/me
SchedulesController_2024_06_11_createSchedule	write	POST	/v2/schedules
BookingAttendeesController_2024_08_13_getBookingAttendee	read	GET	/v2/bookings/{bookingUid}/attendees/{attendeeId}
BookingAttendeesController_2024_08_13_getBookingAttendees	read	GET	/v2/bookings/{bookingUid}/attendees
BookingsController_2024_08_13_getBookingRecordings	read	GET	/v2/bookings/{bookingUid}/recordings
MeController_getMe	read	GET	/v2/me
UserVerifiedResourcesController_getVerifiedEmailById	read	GET	/v2/verified-resources/emails/{id}
UserVerifiedResourcesController_getVerifiedEmails	read	GET	/v2/verified-resources/emails