Authorization

Microsoft EWS deprecation for Office 365

This page describes what Cronofy is doing in response to Microsoft retiring Exchange Web Services (EWS) for Exchange Online, and the steps you need to take so your users’ Office 365 calendars keep syncing.

Graph API for Office 365

Cronofy developed a new integration for connecting Office 365 calendars using Microsoft’s Graph API which was first made available in November 2021.

Microsoft’s Graph API provides two key benefits:

Cronofy can request more granular permissions than EWS, leading to less friction in administrator consent
Cronofy can use Teams conferencing as an integrated conferencing provider, with no additional end-user authorization required, in the same way Google Meet works for Google Calendars

Since 2021 we have offered it as an opt-in feature for existing API integrations, enabling it by default for new API integrations since February 2023, and making it the default for all applications from June 7, 2024.

Why are my profiles disconnecting from Cronofy?

There are multiple potential reasons behind disconnections between your calendar provider and Cronofy.

What should I do if I receive a relink email from Cronofy?

If one of your calendars becomes disconnected, you’ll receive a relink email from Cronofy. This email will come from support@cronofy.com, usually under the name of the application you’re connected through (for example, “Cronofy Scheduler” below), and lets you know your calendar has stopped syncing.

How to acknowledge a calendar reconnection via Cronofy's API?

Profiles can become disconnected between Cronofy and the Calendar server.

Why do I keep getting errors.unknown_or_used when requesting an access_token?

The code that is generated when a user goes through the authorization process is restricted in a number of ways. This error means one of two things:

Why do I get invalid_grant when requesting access token?

This signifies that the code is unrecognized or has already been used, or that the redirect_uri does not match the one given when requesting the user’s authorization.

Office365 Graph Role-Based Access Control (RBAC)

This is a variant of the Office 365 Graph service account connection for customers whose security policy forbids granting Cronofy a tenant-wide application permission. Instead of consenting to Calendars.ReadWrite across the whole tenant, the administrator authorizes Cronofy on identity alone and then scopes its access to a chosen set of mailboxes with Exchange Online Role-Based Access Control (RBAC).

Why do I get the same account_id and refresh_token for different users?

By default when a user authorizes multiple calendar service accounts with your application the Cronofy API links those service accounts under one Cronofy account. This makes sense in production but can create some, on the face of it, odd behaviour in development.

Are Exchange Server Subscription Edition (SE) calendar connections supported?

Exchange Server Subscription Edition (SE) calendar connections are supported.

Microsoft Outlook.com API deprecation

This page describes what Cronofy is doing in response to Microsoft deprecating their Outlook.com API in 2022.

Why do I get a CORS error : “No ‘Access-Control-Allow-Origin’ header is present on the requested resource”?

If you try to pass an access_token (either personal or generated from an authorization exchange) from a browser XMLHttp request for example you will receive an error:

No 'Access-Control-Allow-Origin' header is present on the requested resource

The 'Access-Control-Allow-Origin' header has a value that is not equal to the supplied origin

Why do access_tokens expire and how can you refresh them?

Our API expires the access_token in order to reduce the risk of your users’ calendar data being compromised. When you obtain authorization to access a user’s calendar, a refresh_token will be issued alongside the access_token to allow your application to obtain a new access_token without user involvement.

Can I exclude a calendar provider during authorisation?

It is not possible to directly filter the list of providers shown on the OAuth screen, but you can build your own provider selection UI by utilising the provider_name parameter.

Best practices for storing and using authentication tokens

The majority of APIs Cronofy provides make use of two different authorization models: “Application level”, and “User level”. Both require you to store and make use of a secret value that you will need to securely store.

Which calendars does Cronofy sync?

When a user connects a calendar account, Cronofy syncs the calendars that belong to that account. Exactly which calendars that includes depends on the calendar provider.

Shared calendars

The process of connecting a shared calendar will depend on whether you’re connecting the calendar individually or via an organization.