Pyas calendarsWhat calendar APIs don't tell you
How Google Calendar, Microsoft Graph and Zoom really behave: OAuth review, tokens, webhooks, time zones and meeting links. Each guide opens with the answer and ends with code that runs.
Agents
- How to give an AI agent access to Google Calendar and Outlook with MCPAn MCP server gives an agent calendar tools on behalf of one user. Google's Calendar MCP server is in developer preview and needs your own OAuth client marked as an AI agent from November 11, 2026.
- Give an AI agent access to someone's calendar safely: scopes, confirmation and prompt injectionWhat can go wrong when an AI agent reads and writes calendars, from invitations it sends without asking to instructions hidden in event titles, and the controls that limit it: narrow scopes, human confirmation, tool annotations, test data and version checks.
- How to add Google Calendar or Outlook connections to a Lovable, Bolt or Replit appLovable's Google connector and Replit's connectors act as the builder's account. Letting each user connect their own calendar takes your own OAuth app, and Google's testing limits apply everywhere.
Calendars
- Google Calendar, Outlook and Zoom APIs side by sideThe Google Calendar API, Microsoft Graph and the Zoom API compared on sign-in, tokens, rate limits, push notifications, sync, recurrence, time zones, meeting links, deletions and batching, with each provider's own numbers.
- How to add a Google Meet, Teams or Zoom link to a calendar event with an APIGoogle Meet needs a conference createRequest and conferenceDataVersion=1. Teams needs isOnlineMeeting on a work calendar. Zoom is a separate meeting whose join_url you put on the event.
- How to get free/busy across Google and Outlook calendars in the right time zonesQuery Google with freeBusy.query and Microsoft 365 with getSchedule, convert both to UTC intervals, merge them, then find gaps in the user's IANA time zone. Outlook.com needs calendarView instead.
- How to build calendar webhooks that keep working (Google push channels and Microsoft Graph subscriptions)Google channels expire and can't be renewed, Graph subscriptions last under seven days, and both providers drop notifications. Treat each notification as a hint and sync from a stored cursor.
- Store your own data on calendar events: Google extended properties, Graph extensions, or metadataHow to attach your own IDs and fields to Google Calendar and Outlook events: Google's extendedProperties limits, Microsoft Graph open extensions and extended properties, their quirks, and a metadata store that works the same on both.
- Two-way calendar sync with Google Calendar and Outlook: the architecture, and the edge cases that break itHow to keep your app and your users' Google and Outlook calendars in step: a windowed full sync, sync tokens and delta queries, push as a trigger, and the edge cases that break sync: echoes, deletions, recurring series, changing IDs and conflicts.
- Webhooks vs polling for Google Calendar and Outlook changesShould you poll Google Calendar and Outlook for changes or use push notifications? What each costs, how reliable each is, Graph's latency and delivery rules, and the hybrid both providers recommend.
- Never create a calendar event twice: idempotent writes on Google Calendar and OutlookA timeout and a retry can put the same meeting on someone's calendar twice. How Google's client-supplied event IDs and Microsoft Graph's transactionId prevent duplicates, where they fall short, and how an Idempotency-Key works.
- Time zones in calendar APIs: IANA vs Windows names, clock changes and all-day eventsHow Google Calendar and Microsoft Graph represent times and time zones, why Outlook returns UTC and Windows zone names, how clock changes break recurring events, and how to store times so an event never shifts by an hour.
- Recurring events across Google Calendar and Outlook: RRULE vs Graph recurrence patternsHow Google Calendar stores recurrence as RFC 5545 RRULE lines and Microsoft Graph as patternedRecurrence, how each represents occurrences, exceptions and cancellations, which rules Outlook can't express, and how to edit one occurrence or "this and following".
- Book meeting rooms in Google Workspace and Microsoft 365 with an APIHow to list meeting rooms and book them through the Google Calendar and Admin SDK Directory APIs and Microsoft Graph's Places API: the scopes and admin consent each needs, how rooms accept or decline, and how to find a time when people and a room are free.
- Store calendar OAuth tokens safely: encryption, refresh and revocationHow to store Google, Microsoft and Zoom OAuth tokens for calendar access: encryption at rest with keys kept apart, refreshing without races, handling rotated refresh tokens, why tokens stop working, and how revocation works on each provider.
- Find a meeting time across several people's calendars and working hoursHow to find times when several people on Google Calendar and Outlook are all free, inside each person's working hours and time zone: where working hours come from, Graph's findMeetingTimes, buffers, minimum notice, optional attendees and rooms.
Google Calendar
- How long does Google's OAuth review take for a calendar app?Google says 3 to 5 business days for sensitive scopes like Calendar; its own FAQ says 10, and developers in 2026 report weeks to months. What the review asks for, where the time goes, and how to ship without it.
- What "Google hasn't verified this app" and "Access blocked" mean for a calendar appGoogle shows the unverified app warning when an app asks for calendar scopes before verification. "Access blocked" usually means a Testing app and an account not on its test user list.
- Why does my Google Calendar refresh token expire after 7 days?Google issues 7-day refresh tokens to External apps in Testing. Publish to In production and have users reconnect. Other causes of invalid_grant, and how to handle the ones you can't prevent.
- Is the Google Calendar API free? Quotas, limits and the 2026 changesStandard use of the Google Calendar API costs nothing. New quotas apply to projects created since May 1, 2026, and Google plans charges above them, with no price or date announced yet.
- "Service accounts cannot invite attendees without Domain-Wide Delegation of Authority"A Google service account can't add attendees to an event as itself. It has to impersonate a user through domain-wide delegation, which only covers one Workspace domain, or you use per-user OAuth.
- Google service account or OAuth for calendar access: which one, and whyWhen a Google service account with domain-wide delegation fits calendar access, when per-user OAuth does, and why products whose users are on many domains or on Gmail need OAuth.
Outlook
- How to fix "Need admin approval" (AADSTS65001, AADSTS90094) for an Outlook calendar appMicrosoft's default consent policy no longer lets users approve Calendars permissions themselves. An administrator grants consent once for the organization, then everyone can connect.
- How to use the Outlook Calendar API with Microsoft Graph in Node.jsSign users in with MSAL Node and offline_access, read events from /me/calendarView, send Prefer: outlook.timezone, follow @odata.nextLink, and wait out 429s with Retry-After.
- Microsoft Graph or EWS for Outlook calendars after the EWS retirementEWS in Exchange Online is blocked by default from October 1, 2026 and shut down for good on April 1, 2027. Calendar code moves to Microsoft Graph. Exchange Server on-premises keeps EWS.
Zoom
Field notes
What the providers do that their docs don't say, found while testing Pyas on real accounts. Each note has the evidence and the date we saw it.
- Google keeps deleted events, and a read still returns themReading a deleted Google Calendar event by its ID returns the whole event with status "cancelled", not a 404, and updating it still works. How to tell, and why a sync needs those cancelled entries.
- Outlook stores every all-day event in UTCAn all-day event created through Microsoft Graph is kept as midnight to midnight UTC, whatever time zone you send. Read naively, it lands on the wrong day west of London. How to read it, and what it does to free/busy.
- Outlook.com changes an event's change key seconds after creating itOn Outlook.com, a new event's changeKey moves 0.5 to 2.5 seconds after it is created, with nothing else changed. An update sent with the change key from the create is refused. What we measured, and a version that works.
- Teams on a personal Microsoft account saves the event without a linkAsk Microsoft Graph for a Teams meeting on an Outlook.com calendar and the event is created without one, and without an error. How to check first, and what to offer instead.
- Updating an Outlook event's description removes its Teams join linkMicrosoft Graph replaces an event's body whole, and the Teams join details live in that body. Change the description and attendees lose the link. How to keep it.
- Microsoft Graph v1.0 refuses link attachments on Outlook eventsAttaching a link (a reference attachment) to an Outlook event through Graph v1.0 fails with "The property '' is required" on Outlook.com and Microsoft 365. Why, and what works instead.
- Three Canadian time zones Outlook uses that older Windows-to-IANA mappings lackOutlook mailboxes can be set to British Columbia, Alberta or Manitoba Standard Time. CLDR's Windows-to-IANA mapping only added them in release 49, in October 2026, so most libraries still lack them and fall back to UTC. The mapping, and the 2026 rule changes behind it.
- Zoom refuses every localhost redirect URL, even allow-listed onesA standard Zoom OAuth app refused localhost and 127.0.0.1 as redirect URLs, over http and https, even as the main redirect URL and on the allow list. What we tested, what Zoom's docs say, and how to develop a Zoom integration anyway.