Cal.com API
Cal.com is an open-source scheduling infrastructure for booking appointments and meetings. Its REST API allows agents to manage event types, create and cancel bookings, check availability, manage users and teams, and receive webhook events on booking state changes.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Cal.com scheduling API. API key auth. Self-hostable for privacy. Attendee data is PII. OAuth2 for user-context operations. Open source — audit the code.
⚡ Reliability
Best When
An agent needs to automate scheduling for a human — especially in a sales, recruiting, or support context where meeting booking is a core workflow step.
Avoid When
You need enterprise-grade SLAs and support, or complex scheduling logic that requires custom calendar system integration.
Use Cases
- • Booking meetings or appointments on behalf of users from an agent
- • Checking availability and suggesting time slots in automated workflows
- • Canceling or rescheduling bookings based on agent-detected conditions
- • Creating event types programmatically for different appointment categories
- • Syncing booking data with CRMs or downstream scheduling systems
Not For
- • Enterprise room booking or resource management at large scale
- • Complex multi-location scheduling with physical resource constraints
- • Agents needing sub-second booking confirmation
Interface
Authentication
API key for personal/agent use; OAuth 2.0 for building apps on top of Cal.com. For self-hosted deployments, the API key is generated in instance settings. Cloud API uses api.cal.com with apiKey query param or Authorization header.
Pricing
Self-hosted is fully free including all features. Cloud free tier limits event types which is restrictive for agents. The open-source nature means agents can run against a local instance with full control.
Agent Metadata
Known Gotchas
- ⚠ API v1 and v2 co-exist with different endpoint paths and response formats — check which version each endpoint uses
- ⚠ No idempotency keys — duplicate bookings possible on retry; check before creating
- ⚠ Cloud rate limits undocumented; self-hosted deployments have no enforced limits (good for local agents)
- ⚠ Timezone handling requires explicit timezone parameter; default behavior can create booking time confusion
- ⚠ Webhook signature verification uses HMAC-SHA256 — validate to prevent spoofing
- ⚠ Self-hosted API sometimes diverges from cloud API in feature availability
- ⚠ Available time slot calculation depends on calendar integrations being properly configured on the target account
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Cal.com API.
Scores are editorial opinions as of 2026-03-06.