OAuth explained: how the calendar connection is safe
Agentric Team ·
When you click "Connect Google Calendar", Google asks you to approve access. Here's what actually happens — and what it does and doesn't allow us to do.
What OAuth is
OAuth is the standard for granting a third party limited access to your account — without giving them your password. Instead of credentials, Google issues a token with specific, scoped permissions. You approve it on Google's site; we receive the token, never your password.
The flow
- You click Connect → we send you to Google with a list of requested scopes.
- Google's consent screen shows exactly what we're asking for — calendar access.
- You approve → Google gives us an access token + refresh token.
- We store the tokens and use them to call the Calendar API on your behalf.
- When the token expires, the refresh token quietly renews it — no re-approval needed.
What the access allows
- Reading busy time — so the assistant never books over your dentist appointment.
- Creating events — bookings land in your calendar with customer details.
What it does NOT allow
- Your email, Drive, contacts or any other Google data — different scopes, never requested.
- Sharing your calendar with anyone else — it's used only for your agent's availability and bookings.
- Anything after you revoke — disconnect in Settings or at myaccount.google.com/permissions, and access ends instantly.
The state parameter (the security bit)
The OAuth flow includes a signed token tying the approval to your account session — preventing anyone else from connecting their calendar to your tenant, or hijacking your flow. It expires in 15 minutes.
The mental model
OAuth is a valet key, not your master key: it opens exactly one door (your calendar), it can be cancelled anytime, and it never gives us your credentials. That's why "connect your account" is safe — it's designed so that it can't be otherwise.