Connecting via OAuth (Sign In and Approve)
Some AI assistants and MCP hosts let you add PrimeCal as a connector the same way you'd add Google Calendar, Atlassian, or Microsoft 365: you click Connect, sign in to PrimeCal, approve a permission level, and you're done. No copying and pasting an API key.
This page explains what that flow looks like and how to manage the connection afterward. If your AI tool instead asks you to paste a key directly, use Configuring an Agent in PrimeCal and Connecting MCP Hosts instead — both methods reach the same PrimeCal MCP server.
What "Connect via OAuth" Actually Does
When an AI assistant supports OAuth for PrimeCal, "connecting" it means:
- You click Connect (or Add connector, or similar) inside the AI assistant, pointed at PrimeCal.
- The assistant opens PrimeCal in your browser and asks you to sign in, if you aren't already.
- PrimeCal shows a consent screen: who's asking to connect, and what level of access you want to grant.
- You choose a permission level and click Approve (or Deny).
- You're sent back to the AI assistant, now connected.
You never hand the AI assistant your PrimeCal password, and it never sees a static API key. PrimeCal only tells it "this session is allowed to act with these specific permissions, on this user's behalf."
Step 1: Start the Connection From Your AI Assistant
The exact wording varies by product, but look for something like Connect PrimeCal, Add connector, or Manage connectors inside the AI assistant's settings. Choosing it opens PrimeCal in a browser tab or embedded window.
If you're not already signed in to PrimeCal, you'll see the normal PrimeCal login screen first. Sign in as usual — you'll land back on the consent screen automatically afterward.
Step 2: Review the Consent Screen
The consent screen tells you exactly what's about to be connected:
- The name of the AI assistant or tool requesting access, plus its logo and a link to its homepage, if it provided them.
- A short description of the requesting app, if provided.
- A permission level dropdown — this is the important part.
- Approve and Deny buttons.
Choosing a Permission Level
The dropdown only ever shows levels you're allowed to grant — for example, the most powerful admin-only level is hidden unless your account has admin rights. PrimeCal pre-selects the safest option (Minimal) by default. Pick the narrowest level that the assistant actually needs:
| Permission level | Good for |
|---|---|
| Minimal | Smoke-testing a new connection, or an assistant that only needs profile, context, and read-only calendar/task info. |
| All read-only | Browsing calendars, tasks, reservations, and automation state safely — the recommended default for most assistants. |
| Calendar only | An assistant that should only see and manage calendar events — no tasks, reservations, or automation. |
| Tasks & routines | An assistant focused on your task board, checklists, and recurring routines — no calendar or reservation access. |
| Reservations operator | A booking-focused assistant: checking availability and creating reservations. No calendar, task, or automation access. |
| Automation manager | An assistant that reads and triggers your automation rules, with read-only calendar context. |
| Household manager | An assistant tracking household inventory and restock tasks. |
| Operational read/write | An assistant that needs to read everywhere and create or update calendar events, tasks, and reservations — no destructive admin actions. |
| Full MCP admin | Reserved for highly trusted, internal use. Only available if your account has admin rights. |
Selecting a level updates the short description and the list of highlighted capabilities underneath the dropdown, so you can double-check what you're about to grant before approving.
Step 3: Approve or Deny
- Approve sends you back to the AI assistant with access granted at the level you picked.
- Deny sends you back with no access granted — the assistant will need to ask again if you change your mind later.
If your account isn't allowed to grant the level you selected (for example, picking an admin-only level without admin rights), PrimeCal blocks the approval rather than silently granting less access than you saw on screen.
What Happens Behind the Scenes
Approving a connection creates a normal PrimeCal agent — the same kind of agent you'd otherwise create by hand in Agent Settings, with the permission level you picked. That means:
- It shows up in More → AI Agents (MCP) just like any other agent.
- It's subject to the same permission rules as every other agent — it can never do more than your own PrimeCal account can do.
- If you approve the same assistant again later (after revoking it, for example), PrimeCal reuses that same agent instead of creating a duplicate.
Managing Connected Apps
Open More → AI Agents (MCP) to see everything connected to your account, OAuth or not. Agents created through an OAuth connection are marked with a Connected via OAuth badge so you can tell them apart from agents you set up manually with a static API key.
Revoking Access
To disconnect an AI assistant, find its agent in More → AI Agents (MCP) and disable it (the same control used to disable any agent).
Disabling an OAuth-connected agent immediately:
- Revokes the assistant's ability to call PrimeCal.
- Revokes its ability to silently refresh its access behind the scenes.
The assistant will need to go through the connect-and-approve flow again from Step 1 if you want to reconnect it later — it cannot resume access on its own after being disabled.
Frequently Asked Questions
Does the AI assistant ever see my password? No. You always sign in directly on PrimeCal's own login screen, and the assistant never has access to your credentials.
Does my access expire automatically? The assistant's ability to call PrimeCal is refreshed automatically behind the scenes for as long as the connection stays approved, without asking you to sign in again every time. If you don't use a connected assistant for an extended period, or if you revoke it, it will need to go through the consent screen again.
Can I use a static API key instead? Yes. Static API keys (see Configuring an Agent in PrimeCal) still work exactly as before and remain the right choice for command-line tools or scripts that can't do an interactive sign-in. OAuth is an additional, easier path for AI assistants that support it — not a replacement.