66 lines
2.2 KiB
Plaintext
66 lines
2.2 KiB
Plaintext
---
|
|
title: "How to use OAuth to authorize apps with Cal.com accounts"
|
|
---
|
|
|
|
As an example, you can view our OAuth flow in action on Zapier. Try to connect your cal.com account [here](https://zapier.com/apps/calcom/integrations).
|
|
To enable OAuth in one of your apps, you will need a Client ID, Client Secret, Authorization URL, Access Token Request URL, and Refresh Token Request URL.
|
|
|
|
<img src="/images/oauth-zapier.png" />
|
|
|
|
### Authorization URL
|
|
To initiate the OAuth flow, direct users to the following authorization URL:
|
|
- `https://app.cal.com/auth/oauth2/authorize`
|
|
- URL Parameters:
|
|
- *client_id*
|
|
- *state*: A securely generated random string to mitigate CSRF attacks
|
|
- *redirect_uri*: This is where users will be redirected after authorization
|
|
- *scope*: Specify the required scopes. Current scopes include READ_BOOKING and READ_PROFILE. Additional scopes can be added as needed.
|
|
|
|
After users click *Allow*, they will be redirected to the redirect_uri with the code (authorization code) and state as URL parameters.
|
|
|
|
### Access Token Request
|
|
Endpoint: `POST https://app.Cal.com/api/auth/oauth/token`
|
|
|
|
Request Body:
|
|
- *code*: The authorization code received in the redirect URI
|
|
- *client_id*
|
|
- *client_secret*
|
|
- *grant_type*: "authorization_code"
|
|
- *redirect_uri*
|
|
|
|
Response:
|
|
```
|
|
{
|
|
access_token: “exampleAccessToken”
|
|
refresh_token: “exampleRefreshToken”
|
|
}
|
|
```
|
|
|
|
### Refresh Token Request
|
|
Endpoint: `POST https://app.Cal.com/api/auth/oauth/refreshToken`
|
|
|
|
Request Body:
|
|
- *grant_type*: "refresh_token"
|
|
- *client_id*
|
|
- *client_secret*
|
|
|
|
Response:
|
|
```
|
|
{
|
|
access_token: “exampleAccessToken”
|
|
}
|
|
```
|
|
|
|
### Testing OAuth Credentials
|
|
To verify the correct setup and functionality of OAuth credentials you can use the following endpoint:
|
|
`GET https://app.Cal.com/api/auth/oauth/me`
|
|
|
|
Headers:
|
|
- Authorization: Bearer *exampleAccessToken*
|
|
|
|
|
|
### Authorize requests with Bearer token
|
|
Ensure that Cal.com endpoints accessed by the app support authentication via Bearer Token.
|
|
If this is not the case, it will be necessary to update the code accordingly.
|
|
Here is an example of an endpoint that supports both apiKey and Bearer token authentication: [/listBookings endpoint](https://github.com/calcom/cal.com/blob/main/packages/app-store/zapier/api/subscriptions/listBookings.ts)
|