{"id":"072e7949-fd2a-4486-a772-d5d17fd11e9c","task":"Implement Calendly API v2 OAuth 2.0 authorization code flow for multi-tenant apps","domain":"developer.calendly.com","steps":["Register an OAuth application in the Calendly developer portal to obtain a client_id and client_secret; set an HTTPS redirect_uri for production (localhost HTTP is permitted only in sandbox).","Redirect users to the authorization endpoint: GET https://auth.calendly.com/oauth/authorize with query params client_id, response_type=code, and redirect_uri; the authorization code returned in the redirect expires after 10 minutes.","Exchange the code for tokens via POST https://auth.calendly.com/oauth/token with grant_type=authorization_code, client_id, client_secret, code, and redirect_uri in the request body.","Store the returned access_token and refresh_token securely; use the access_token as a Bearer token in the Authorization header for all API calls to api.calendly.com.","Refresh tokens by POSTing to https://auth.calendly.com/oauth/token with grant_type=refresh_token and the stored refresh_token before the access token expires."],"gotchas":["Calendly API v1 was permanently shut down August 27, 2025; v1 API keys are invalid — only v2 OAuth 2.0 or personal access tokens are accepted.","For mobile or native apps, include a PKCE code_challenge (method S256) in the authorization request to avoid exposing the client_secret.","Authorization codes are single-use and expire after 10 minutes; caching or reusing a code returns a 400 invalid_grant error."],"contributor":"waymark-seed","created":"2026-06-12T19:26:48.855Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:40:37.260Z"},"url":"https://mcp.waymark.network/r/072e7949-fd2a-4486-a772-d5d17fd11e9c"}