calendar/docs/api-reference/v2/oauth.mdx

---
title: "OAuth"
description: "Authorize apps with Cal.com accounts using OAuth"
---

As an example, you can view our OAuth flow in action on Zapier. Try to connect your Cal.com account [here](https://zapier.com/apps/calcom/integrations). To enable OAuth in one of your apps, you will need a Client ID, Client Secret, Authorization URL, Access Token Request URL, and Refresh Token Request URL.

<Frame>
  ![](/images/oauth-zapier.png)
</Frame>

### Get your OAuth "Continue with [Cal.com](http://Cal.com)" Badge

- https://app.cal.com/continue-with-calcom-coss-ui.svg
- https://app.cal.com/continue-with-calcom-dark-rounded.svg
- https://app.cal.com/continue-with-calcom-dark-squared.svg
- https://app.cal.com/continue-with-calcom-light-rounded.svg
- https://app.cal.com/continue-with-calcom-light-squared.svg
- https://app.cal.com/continue-with-calcom-neutral-rounded.svg
- https://app.cal.com/continue-with-calcom-light-squared.svg


### OAuth Client Credentials

Only the Cal.com team can create new OAuth clients. Please fill out [this form](https://i.cal.com/forms/4052adda-bc79-4a8d-9f63-5bc3bead4cd3) and book us to get started.

The Cal.com team will register the app and provide you with the Client ID and Client Secret. Keep these credentials confidential and secure.

### Authorization URL

To initiate the OAuth flow, direct users to the following authorization URL:

- `https://app.cal.com/auth/oauth2/authorize`
- URL Parameters:
  - _client_id_
  - _state_: A securely generated random string to mitigate CSRF attacks
  - _redirect_uri_: This is where users will be redirected after authorization

After users click _Allow_, they will be redirected to the redirect_uri with the code (authorization code) and state as URL parameters.

### Access Token Request

Endpoint: `POST https://app.cal.com/api/auth/oauth/token`

Request Body:

- _code_: The authorization code received in the redirect URI
- _client_id_
- _client_secret_
- _grant_type_: "authorization_code"
- _redirect_uri_

Response:

```
{
    access_token: “exampleAccessToken”
    refresh_token: “exampleRefreshToken”
}
```

### Refresh Token Request

Endpoint: `POST https://app.cal.com/api/auth/oauth/refreshToken`

Headers:

- Authorization: Bearer _exampleRefreshToken_

Request Body:

- _grant_type_: "refresh_token"
- _client_id_
- _client_secret_

Response:

```
{
    access_token: “exampleAccessToken”,
    refresh_token: "exampleRefreshToken"
}
```

### Testing OAuth Credentials

To verify the correct setup and functionality of OAuth credentials you can use the following endpoint: `GET https://api.cal.com/v2/me`

Headers:

- Authorization: Bearer _exampleAccessToken_