Authorization
Read as MarkdownManaged scheduling acts on a Cronofy Organizational Unit: its members, their connected calendars and the scheduling rules set up in Cronofy. Your application therefore authorizes against the Organizational Unit rather than against individual calendars.
| Method | When it fits |
|---|---|
| Managed Organizational Unit | Your application provisions an Organizational Unit for each customer and runs scheduling for them. Provisioning returns an access token with the organizational_unit_scheduling scope, as if the customer had authorized through Organization Connect. |
| Internal Application | Your application serves one Organizational Unit, typically your own company’s. Authenticate with the application’s client_secret; no OAuth flow is needed. |
| Organization Connect | Your application serves many customers, each with their own Organizational Unit. Each customer authorizes your application, for example with the organizational_unit_scheduling scope. |
| User impersonation | You need to act as a specific member of the Organizational Unit. Pass their sub in the Cronofy-Impersonate header alongside either of the above. |
Embedded Scheduler #
The Scheduler embed authenticates in the browser with an Embed Token, a JWT your server signs with the application’s Embed Secret. See Embed authentication for generating tokens, and Onboarding users for passing one through sign up.
MCP Server #
The MCP Server
accepts an Internal Application’s client_secret, or takes users through an
OAuth 2.0 flow for a standard application.