Calendly

Overview

Connect your users to Calendly for scheduling automation, event management, and availability tracking.

Property	Value
Provider ID	calendly
Category	Productivity
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Calendly OAuth App

Sign up for the Calendly Developer Portal

Go to developer.calendly.com and sign up with GitHub or Google. The developer account is separate from a regular Calendly user account.

Create an application

Open My OAuth Apps and click Create New App.

Configure the application

Choose:

• Application type (web or native)
• Environment — Sandbox for development (HTTP localhost allowed), Production for live data (HTTPS only)

Add the redirect URI

Add the Redirect URI from the Developer Portal to the Redirect URI field.

Get credentials

Copy the Client ID, Client Secret, and Webhook signing key. The secret and signing key are only displayed once.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Calendly provider

Go to OAuth Providers > Add Provider > Calendly.

Enter credentials

• Client ID: Paste your Calendly Client ID
• Client Secret: Paste your Calendly Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
default	Access to Calendly scheduling data including events, invitees, and availability

Notes

• The Calendly developer account is separate from a regular Calendly user account — sign in with GitHub or Google.
• Use the Sandbox environment for development; HTTP localhost redirect URIs are allowed there. Production requires HTTPS.
• Calendly OAuth recommends PKCE with the S256 code_challenge_method (RFC 7636).
• The Client Secret and Webhook signing key are revealed only at creation — save them immediately.
• See the Calendly OAuth application documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
organization-invitations/create	admin, send	POST	/organizations/{uuid}/invitations
data-compliance/delete-invitees	delete, write	POST	/data_compliance/deletion/invitees
organization-memberships/remove	admin, delete	DELETE	/organization_memberships/{uuid}
scheduled-events/cancel	delete, write	POST	/scheduled_events/{uuid}/cancellation
webhook-subscriptions/delete	admin, delete	DELETE	/webhook_subscriptions/{webhook_uuid}
webhook-subscriptions/create	admin, write	POST	/webhook_subscriptions
scheduling-links/create	write	POST	/scheduling_links
event-type-available-times/list	read	GET	/event_type_available_times
event-types/get	read	GET	/event_types/{uuid}
event-types/list	read	GET	/event_types
invitees/get	read	GET	/scheduled_events/{event_uuid}/invitees/{invitee_uuid}
invitees/list	read	GET	/scheduled_events/{event_uuid}/invitees
organization-invitations/list	read	GET	/organizations/{uuid}/invitations
organization-memberships/get	read	GET	/organization_memberships/{uuid}
organization-memberships/list	read	GET	/organization_memberships
scheduled-events/get	read	GET	/scheduled_events/{uuid}
scheduled-events/list	read	GET	/scheduled_events
user-availability-schedules/list	read	GET	/user_availability_schedules
user-busy-times/list	read	GET	/user_busy_times
users/get	read	GET	/users/{uuid}
users/me	read	GET	/users/me
webhook-subscriptions/get	read	GET	/webhook_subscriptions/{webhook_uuid}
webhook-subscriptions/list	read	GET	/webhook_subscriptions