Nothing to provision means nothing to leak, and the read and write scopes let a diary-reading assistant be genuinely read-only. But the requirement is real: if your client asks you to paste a client id, it will not work here, and no amount of configuration changes that. Check the client before planning the integration. Single-use booking links are the tool worth knowing about — they let an agent hand out one appointment without exposing a permanent calendar link.
Calendly's own hosted endpoint, mapping their public API v2. Officially hosted only — self-hosting is not supported.
- List event types and check available times
- Adjust scheduling availability
- Fetch scheduling links, and generate single-use booking links
- Create and cancel scheduled events
OAuth 2.1 with PKCE and dynamic client registration — the client registers itself, so there are no credentials to pre-provision. That is also the constraint: a client that needs a manually entered client id and secret cannot connect at all. Scopes split read from write.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen