Summary
- Point Cal OAuth token exchange at the documented v2 token endpoint.
- Add refresh parameters so access tokens can be refreshed with grant_type=refresh_token.
- Configure Cal token exchange and refresh client auth to send client credentials in the request body, matching Cal docs.
RCA
Cal access tokens expire after 30 minutes, but the generated Cal OAuth config did not include refresh_params. It also used the legacy app.cal.com token exchange URL while refresh used the v2 API token endpoint. The official Cal docs use POST https://api.cal.com/v2/auth/oauth2/token for both authorization-code exchange and refresh, with refresh requests including grant_type=refresh_token and refresh_token; confidential clients include client_id and client_secret in the body.
Validation
- bun --check apps/cal/config.ts
- bun run auth-config/src/configToJson.ts apps/cal/config.ts
- bunx prettier --check apps/cal/config.ts
Linear: INT-1600