Calendly

Overview

Connect your users to Calendly for scheduling automation, event management, and availability tracking.

Property	Value
Provider ID	calendly
Category	Productivity
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Calendly OAuth App

Sign up for the Calendly Developer Portal

Go to the Calendly Developer Portal and click Log in / Sign up — sign up with GitHub or Google. The developer account is separate from a regular Calendly user account.

Create an application

Create a new OAuth application from the developer console and enter its name.

Configure the application

Choose:

• Kind of application — web (Alter Vault exchanges the authorization code as a confidential web client)
• Environment — Sandbox for development (HTTP localhost allowed), Production for live data (HTTPS only)

Add the redirect URI

Add the Redirect URI from the Developer Portal to the Redirect URI field.

Enable the scopes the application will request

In the app’s scope settings, enable every scope the application will request. Newly created Calendly apps grant no API access until scopes are explicitly enabled — a scope requested at authorization but not enabled on the app is rejected.

Get credentials

Copy the Client ID, Client Secret, and Webhook signing key. The secret and signing key are only displayed once.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Calendly provider

Go to OAuth Providers > Add Provider > Calendly.

Enter credentials

• Client ID: Paste your Calendly Client ID
• Client Secret: Paste your Calendly Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
users:read	Read user profiles (GET /users/me, GET /users/{uuid}) — the minimum scope; validates the connection
event_types:read	Read event type details and available times
event_types:write	Create and modify event types
scheduled_events:read	Read scheduled events and event invitee information
scheduled_events:write	Create event invitees, cancel events or mark invitees as no-show
availability:read	Read availability schedules and available times
availability:write	Modify availability schedules
locations:read	Read location details
routing_forms:read	Read routing forms and their submissions
shares:write	Create and customize a single-use scheduling link from an existing event type
scheduling_links:write	Create single-use scheduling links
groups:read	Read groups and group memberships
organizations:read	Read organization details, memberships, and invitations
organizations:write	Manage organization memberships and invitations
webhooks:read	Read webhook subscriptions
webhooks:write	Create and delete webhook subscriptions
activity_log:read	Read organization activity log entries
data_compliance:write	Submit data-deletion (compliance) requests
outgoing_communications:read	Read outgoing communication records
contacts:read	Read contacts
contacts:write	Create and modify contacts
meeting_recaps:read	Read meeting recaps (Notetaker)
meeting_recaps:write	Manage meeting recaps (Notetaker)

Notes

• The Calendly developer account is separate from a regular Calendly user account — sign in with GitHub or Google.
• Newly created Calendly apps are deny-by-default: enable the scopes the application will request in the app’s scope settings, or the authorization is rejected. Legacy apps created before scoped permissions retain full access.
• Use the Sandbox environment for development; HTTP localhost redirect URIs are allowed there. Production requires HTTPS.
• Calendly OAuth recommends PKCE with the S256 code_challenge_method (RFC 7636); Alter Vault sends it, and authenticates the token request with the Client ID and Client Secret in an HTTP Basic Authorization header — the method Calendly documents for web clients.
• Access tokens expire after 2 hours; refresh tokens are single-use and rotate on every refresh (Alter Vault stores the new refresh token from each response).
• The Client Secret and Webhook signing key are revealed only at creation — save them immediately.
• See the Calendly scope catalog and the OAuth application documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
organization-invitations/create	admin, send	POST	/organizations/{uuid}/invitations
data-compliance/delete-invitees	delete, write	POST	/data_compliance/deletion/invitees
organization-memberships/remove	admin, delete	DELETE	/organization_memberships/{uuid}
scheduled-events/cancel	delete, write	POST	/scheduled_events/{uuid}/cancellation
webhook-subscriptions/delete	admin, delete	DELETE	/webhook_subscriptions/{webhook_uuid}
webhook-subscriptions/create	admin, write	POST	/webhook_subscriptions
scheduling-links/create	write	POST	/scheduling_links
event-type-available-times/list	read	GET	/event_type_available_times
event-types/get	read	GET	/event_types/{uuid}
event-types/list	read	GET	/event_types
invitees/get	read	GET	/scheduled_events/{event_uuid}/invitees/{invitee_uuid}
invitees/list	read	GET	/scheduled_events/{event_uuid}/invitees
organization-invitations/list	read	GET	/organizations/{uuid}/invitations
organization-memberships/get	read	GET	/organization_memberships/{uuid}
organization-memberships/list	read	GET	/organization_memberships
scheduled-events/get	read	GET	/scheduled_events/{uuid}
scheduled-events/list	read	GET	/scheduled_events
user-availability-schedules/list	read	GET	/user_availability_schedules
user-busy-times/list	read	GET	/user_busy_times
users/get	read	GET	/users/{uuid}
users/me	read	GET	/users/me
webhook-subscriptions/get	read	GET	/webhook_subscriptions/{webhook_uuid}
webhook-subscriptions/list	read	GET	/webhook_subscriptions