# Calendly: OAuth app setup and approval
Self-serve · Sourced · updated 27 Oct 2026 · https://oauth-guide.akshatsethi.com/apps/calendly

> Calendly is self-serve. You sign up for a developer account, create a Production OAuth app with an HTTPS redirect URI and the scopes you need, and any Calendly user can connect. Calendly's docs describe no app review step.

- **Your hands-on work:** 20–60 min
- **Waiting on Calendly:** None
- **First user can connect:** Today, in about 20 to 30 minutes
- **Why Self-serve:** Calendly's docs describe creating an OAuth app in the developer console and using it at once, with no review, verification or listing step.
- **Using Composio?** Composio has a managed Calendly OAuth app, so you can prototype without registering your own. Register your own Production app before launch so your app name is on the consent screen. The separate 'Calendly MCP' toolkit needs your own app.

## Path to launch
### Build: Sandbox app
- Who can connect: You, plus any Calendly account you test with, through a Sandbox app that can use a localhost redirect URI.
- What users see: Calendly's standard consent screen showing your app name and the scopes you request.
- Effort: 15–30 min · Wait: None
- Next: Create a second app with the Production environment and an HTTPS redirect URI.
- _(Docs [1])_

### Launch: Production app
- Who can connect: Any Calendly user on any plan, including Free. Webhooks need a paid plan on the user's account.
- What users see: Calendly's standard consent screen showing your app name and the scopes you request.
- Effort: 10–30 min · Wait: None
- _(Docs [1, 3], medium confidence)_

## Before you start
- [ ] **Calendly developer account** (You). This is separate from a regular Calendly user account. You sign up at developer.calendly.com with GitHub or Google. _(Docs [1])_
- [ ] **HTTPS redirect URI** (You). A Production app accepts only HTTPS redirect URIs. Sandbox apps also allow http://localhost. _(Docs [1])_
- [ ] **Paid Calendly plan for webhooks (only if you use them)** (You). The connecting user's account needs a Standard, Teams or Enterprise plan before you can create webhook subscriptions. Regular GET and POST API calls work on any plan, including Free. _(Docs [3])_

## Steps
1. **Sign up for a Calendly developer account** (You, 2–5 min). At developer.calendly.com, click Sign Up in the top right and sign in with GitHub or Google. This account is separate from your Calendly user account. _(Docs [1])_
   - Open developer.calendly.com
   - Click Sign Up
   - Sign in with GitHub or Google
   - Agent: A person has to complete the sign-in. After that, an agent can work in the console.
   - Watch out: Signing in to calendly.com does not give you a developer console. The developer account is separate.
2. **Create a Sandbox OAuth app** (Agent, 5–10 min). In My Apps, create an app. Set a name, Kind (Web or Native), Environment = Sandbox and your redirect URI, then select the scopes your integration needs. _(Docs [1, 2, 6])_
   - Name: your app name (users see it on the consent screen)
   - Kind: Web for a server-side OAuth client, Native for a mobile or desktop app
   - Environment: Sandbox
   - Redirect URI: your OAuth client's callback URL (http://localhost is allowed in Sandbox)
   - Scopes: pick the minimum set, for example users:read scheduled_events:read event_types:read, plus webhooks:write if you use webhooks
   - Agent: An agent can fill the form. Stop when the credentials page appears and hand over to a person.
   - Watch out: New apps get no API access to anything outside the scopes you select. A scope you request in the authorize URL that is not enabled on the app returns 'requested scope is invalid, unknown or malformed'.
3. **Save the client ID, client secret and signing key** (You, 2–5 min). Calendly shows the Client ID, Client Secret and Webhook signing key once. Store them in your secret manager or enter them into your OAuth client's settings yourself. _(Docs [1])_
   - Copy Client ID
   - Copy Client Secret into secure storage
   - Copy Webhook signing key into secure storage
   - Agent: An agent can copy the Client ID. A person must handle the client secret and the signing key.
   - Watch out: The secret and signing key are not shown again, even when you edit the app. If you lose them, you have to create a new app.
4. **Configure your OAuth client with Calendly endpoints** (Agent, 5–10 min). Authorize at https://auth.calendly.com/oauth/authorize and exchange the code at https://auth.calendly.com/oauth/token. Pass scopes space-separated and use PKCE with S256. Calendly recommends PKCE for all apps but does not enforce it for Web apps. _(Docs [1, 7], medium confidence)_
   - Authorization URL: https://auth.calendly.com/oauth/authorize
   - Token URL: https://auth.calendly.com/oauth/token
   - Scopes: space-separated, exactly matching the scopes enabled on the app
   - Enable PKCE (S256)
   - Agent: An agent can set the non-secret fields. A person enters the client secret.
   - Watch out: If your OAuth client sends PKCE parameters inconsistently, Calendly returns 'missing required parameter code_verifier'.
5. **Connect your own Calendly account** (Agent, 3–10 min). Run the authorize flow, approve the consent screen, and call GET https://api.calendly.com/users/me to confirm the token works. _(Docs [1], medium confidence)_
   - Agent: An agent can run the test once a person has signed in to Calendly.
6. **Create a Production app with an HTTPS redirect** (Agent, 5–15 min). Create a second app with Environment = Production, your HTTPS redirect URI and the same scopes. Then save its new credentials and switch your OAuth client to them. _(Docs [1])_
   - Environment: Production
   - Redirect URI: your HTTPS callback URL
   - Scopes: same as the Sandbox app
   - A person saves the new client secret and signing key
   - Agent: An agent fills the form. A person handles the new secret.
   - Watch out: A Production app rejects HTTP redirect URIs, including localhost.

## Scopes
New OAuth apps get no API access until you select scopes. Calendly lists 23 scopes, and each :write scope includes the matching :read. The docs mention no scope that needs extra approval from Calendly. Apps created before scopes were introduced keep full access.

| Scope | Grants | Level | Consequence |
|---|---|---|---|
| `users:read, scheduled_events:read, event_types:read` | Read the user's profile, booked meetings and event types | basic | Nothing beyond user consent |
| `webhooks:write` | Create webhook subscriptions | basic | No review, but it only works if the user has a Standard, Teams or Enterprise plan |
| `organizations:write, data_compliance:write, activity_log:read` | Org admin, data deletion and audit log access | basic | No review is documented. Some of these endpoints are Enterprise-only or need an org admin |

## When you get stuck
- **'An error has occurred: the requested scope is invalid, unknown or malformed'.** The authorize URL asks for scope names that are not enabled on the app, or that are formatted wrongly (commas, dot-style names, stray characters). Fix: Use exactly the scope names enabled on the app, separated by spaces. _(Community [6], medium confidence)_
- **Webhook subscription creation fails for some users.** Webhooks need the user to be on a Standard, Teams or Enterprise plan. Fix: Check the user's plan, or fall back to polling the API for users on Free. _(Docs [3])_
- **Connected users suddenly get 401 errors.** Calendly revokes tokens when the user changes their login email, password or login method. Fix: Handle 401 errors by asking the user to reconnect. _(Docs [3], medium confidence)_

## Not confirmed yet
- **Does anyone at Calendly approve the scopes on a new app, or do they only need user consent?** The scopes page says access needs scopes 'requested and approved' but does not name the approver. No source describes a Calendly review. To resolve: Create a Production app with your scopes and check that a different Calendly account can connect right away.
- **Are there connection caps, or other differences between Sandbox and Production apps besides redirect URI rules?** The docs only describe the redirect URI difference. To resolve: Check the developer console or ask in the Calendly community's API & Webhook Help forum.

## Sources
1. [Creating an OAuth app](https://developer.calendly.com/creating-an-oauth-app) (Calendly developer docs). Checked 27 Oct 2026
2. [Authorization Scopes](https://developer.calendly.com/docs/authentication/scopes) (Calendly developer docs). Checked 27 Oct 2026
3. [Frequently asked questions](https://developer.calendly.com/frequently-asked-questions) (Calendly developer docs). Checked 27 Oct 2026
4. [How to register your own Calendly API OAuth app](https://nango.dev/docs/api-integrations/calendly/how-to-register-your-own-calendly-api-oauth-app.md) (Nango docs). Checked 27 Oct 2026
5. [Managed auth toolkits](https://docs.composio.dev/toolkits/managed-auth.md) (Composio docs). Checked 27 Oct 2026
6. [The requested scope is invalid unknown or malformed](https://community.calendly.com/api-webhook-help-61/an-error-has-occurred-the-requested-scope-is-invalid-unknown-or-malformed-3657) (Calendly Community). Not yet checked
7. [Missing required parameter code verifier](https://community.calendly.com/api-webhook-help-61/missing-required-parameter-code-verifier-4746) (Calendly Community). Not yet checked
8. [Rate Limits](https://developer.calendly.com/api-docs/overview/rate-limits) (Calendly developer docs). Not yet checked

Wrong or out of date? POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "calendly", "step": 2, "message": "what you saw"} (step is optional), or call the report_problem MCP tool. The next research run checks it.
Followed it? Say how it went: POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "calendly", "outcome": "worked" | "waiting" | "stuck", "step": 3, "message": "what happened"}, or call the report_setup MCP tool.