Connect Cal.com to Fondoo
Create the key in Cal.com Settings > Developer > API keys. Bookings Fondoo creates email the attendee and need owner approval for agents. Set webhookSecret before webhooks.create.
Credentials
Create an API key in Cal.com settings and store it as apiKey. Choose a 16–200 character webhookSecret and store it before creating webhooks.
Permissions
The key inherits its owner's access. The /me connection test confirms no capability permissions. Agents need owner approval to create bookings.
Capabilities
Read: event_types.list, bookings.list, bookings.get, webhooks.list, webhooks.verify, webhooks.parse. Write: webhooks.create. Destructive: bookings.create (emails the attendee), bookings.cancel, webhooks.delete.
Webhooks
Create with a public HTTPS subscriberUrl and unique supported triggers. Verification checks x-cal-signature-256 against the raw body HMAC and rejects createdAt outside 300 seconds. Parsing returns only event and booking identifiers and occurrence time.
Limits and uncertainties
Local budget: 60 requests per 60 seconds; UNCERTAIN vendor limit varies by account. Respect Retry-After. UNCERTAIN: API key prefix validation is a local contract; vendor formats may change. UNCERTAIN: Settings > Developer > API keys may differ by account; current docs say Settings > Security. UNCERTAIN: Cal.com signs no timestamp header; replay protection uses the signed JSON createdAt. Booking API version: 2024-08-13; event types: 2024-06-14. Booking lists take 1–100; skip 0–10000. At most 10 guests per booking.