Calendar Invites Without OAuth: Five Lessons From a Coffee-Pairing Bot
A Slack bot that pairs people for coffee sends meeting invites through a Google calendar template URL and a downloadable .ics file, avoiding per-user OAuth consent and stored refresh tokens. The team chose this because calendar access would require a second identity system, consent for two providers, and a larger privacy burden. Testing showed Google ignores a missing time and pre-fills an arbitrary slot, so the bot always sends an explicit UTC start and end time. Converting a local 2pm into the correct UTC moment required resolving the time zone offset twice to handle daylight-saving changes, which exposed a rare bug in three New Zealand and Antarctic zones. The team also noted edge cases such as unknown zone names and midnight rendered as hour 24.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in