terminalskills/skills/cal-com
- community
- ext:[{"type":"config","description":"Configuration overrides"}]
Checking that the SKILL.md file is still in the repository.
Cal.com is an open-source scheduling platform for booking pages, availability and calendar sync, with an embed, a REST API v2 and webhooks. Use when the user wants to add a booking widget to a React or plain site, create event types, list free slots, create, cancel or reschedule bookings through the Cal.com API, verify booking webhooks, set up round-robin team events, or self-host a community edition (Cal.diy) with Docker.
Install
npx vskill@latest install terminalskills/skills/cal-comSemi-extensibleMentions customization, but needs skill-specific knowledge. Read the extensible skills standard
SKILL.md
Cal.com — Scheduling Infrastructure
Overview
Cal.com lets people book time on your calendars. You can use it three ways: share a booking link, embed the booker in your site (@calcom/embed-react), or drive it from code through API v2 at https://api.cal.com/v2 and webhooks. Authentication is an API key (Authorization: Bearer cal_live_..., created under Settings > Security) or OAuth; Cal.com recommends OAuth for apps that act for other users. API keys are limited to 120 requests per minute.
Two things changed recently. API v2 versions each endpoint family separately through a required cal-api-version header, and a wrong or missing value silently selects an older, different shape. The Platform plan no longer takes new signups (since 15 December 2025), so the managed-user and x-cal-client-id flows are for existing customers only. Self-hosting now means Cal.diy, an MIT community edition without Teams, Organizations, workflows or SSO.
Instructions
Embed in React
calLink is maria-lopez/discovery-call (or team/sales-eu/product-demo for a team event). Pass the same namespace to getCalApi and <Cal> when a page has more than one embed. Use calOrigin for a self-hosted instance. The package is at 1.5.3 and supports React 18 and 19. Prefilling goes in config (name, email, notes, custom field slugs).
API v2: pick the right version header
Send cal-api-version on every call. The values documented today:
| Endpoint family | cal-api-version | |
|---|---|---|
/v2/bookings (create, get, cancel, reschedule) | 2026-02-25 | |
/v2/event-types, /v2/teams/{teamId}/event-types | 2026-06-12 | |
/v2/slots | 2024-09-04 | |
/v2/schedules | 2024-06-11 |
Responses are { "status": "success", "data": ... }; the helper returns data.
Event types, slots, bookings
start is UTC. Custom field values go in bookingFieldsResponses keyed by slug. A location of type integration only works if that app is already installed on the account (via API only Google Meet, Teams and Zoom can be installed; Cal Video is the default). Rescheduling creates a new booking with a new uid. If the event type has seats or recurrence, the cancel and create bodies differ (seatUid, recurrenceCount); read the booking reference.
Team round-robin and schedules
Team event types are created at POST /v2/teams/{teamId}/event-types (organization and team plan). Scheduling types are lowercase: collective, roundRobin, managed.
Days are names, not numbers. An override replaces that date's availability with the given window.
Webhooks
Create a subscription at /settings/developer/webhooks (or per event type): a subscriber URL, triggers, and an optional secret. On Cal.com cloud the URL must be HTTPS and public. The signature is HMAC-SHA256 of the raw body in the x-cal-signature-256 header.
MEETING_STARTED and MEETING_ENDED have a flat payload (booking fields at the top level next to triggerEvent); all other triggers wrap the booking in payload. The payload version is in the x-cal-webhook-version header. Other triggers include BOOKING_REQUESTED, BOOKING_REJECTED, BOOKING_PAID, BOOKING_NO_SHOW_UPDATED and FORM_SUBMITTED. For seated events attendees holds only the seat that triggered the call.
Self-hosting (Cal.diy)
The calcom/cal.com repository README now points self-hosters to calcom/cal.diy: MIT, no Enterprise features, no hosted version, and the maintainers call it unsuitable for production use. Teams, Organizations, Insights and workflows are removed.
The image is calcom/cal.diy (use the -arm tag suffix on ARM). Push notifications need VAPID keys from npx web-push generate-vapid-keys. For local development, yarn dx starts Postgres in Docker and seeds test users with well-known passwords; never expose that.
Examples
Example 1: Demo booking on the pricing page
User request: "Put a Cal.com booking widget on our pricing page and prefill the visitor's name and email when they are logged in."
Install @calcom/embed-react, render <Cal calLink="maria-lopez/discovery-call" namespace="discovery-call" config={{ name, email }} /> with the values from the session, and call getCalApi({ namespace: "discovery-call" }) once to set theme and layout. The page shows the month view with the visitor's details already filled in; confirmation goes to their email.
Example 2: Sync bookings into a CRM
User request: "When someone books, cancels or moves a call, update our CRM."
Add the route from the Webhooks section, set CAL_WEBHOOK_SECRET in the environment and the same value in the Cal.com webhook form, and subscribe to Booking Created, Cancelled, Rescheduled. A test delivery with a wrong secret returns 401; a real booking creates one saveBooking call keyed by payload.uid, and the response { "received": true } marks it delivered. Use uid (not the numeric bookingId) as the key, since a reschedule produces a new uid and carries the old one in rescheduleUid.
Guidelines
- Always send
cal-api-versionand use the value for that endpoint family; otherwise an older shape is returned or the call 404s. - Verify
x-cal-signature-256against the raw request body before parsing; compare buffers of equal length withtimingSafeEqual. - Respond to webhooks quickly with 2xx and do heavy work asynchronously; deduplicate by
uidandidempotencyKey. - Keep API keys on the server in environment variables; never ship them to the browser. Prefer OAuth for multi-user apps.
- Stay under 120 requests per minute per API key; cache slot queries.
- All times in requests are UTC ISO 8601; pass
timeZonefor display and attendee. - For compliance-driven self-hosting, check that Cal.diy has the features you need (no Teams or SSO); the hosted product or an enterprise license is the supported production route.
Security
- Security scanPassed, 95 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/cal-com/SKILL.md
Popularity
- Repository stars
- 157
- Repository forks
- 21
- 7-day trend score
- 25
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Extension points
configConfiguration overrides
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/terminalskills/skills/cal-com)