[Bug]: Calendly auth configs are unconnectable — derived scopes are refused by the bundled Calendly OAuth app

A Calendly auth config derives its scope set from the tools it is given, and the resulting authorization request is one the bundled Calendly OAuth application is not allowed to make. Calendly rejects it at /oauth/authorize before any consent screen is shown, so the connect never completes. 37 of the toolkit's 52 tools land in this state.

The scope set is refused by Calendly

Same authorize URL, same Calendly OAuth client (the one an auth config for the calendly toolkit produces, redirecting to https://backend.composio.dev/api/v1/auth-apps/add), same logged-in Calendly session. Only scope varies:

scope	Result
(omitted)	consent screen — "Connect Composio to Calendly"
default	consent screen
default groups:read	The requested scope is invalid, unknown, or malformed.
scheduled_events:read	same error
users:read	same error
routing_forms:read	same error
event_types:read	same error
organizations:read	same error
webhooks:read	same error
availability:read	same error

Every one of those seven is a documented Calendly scope (https://developer.calendly.com/scopes), so this is not a spelling problem. The application is refused for granular scopes as such, and a single granular scope is enough — default does not rescue a request it appears in.

Calendly's own documentation explains the shape: OAuth applications predating scoped permissions keep full access and accept only the unscoped grant, while granular scopes have to be requested and approved per application. The bundled Calendly app behaves exactly like one of those, so the scope metadata describes a permission model the app is not enrolled in.

The blast radius is most of the toolkit

POST /api/v3.1/tools/scopes/required over all 52 Calendly tools:

• 15 tools require only default — an auth config restricted to those connects
• 37 tools require at least one granular scope — any auth config containing one cannot be connected

Since the scope set is derived from the tool list, picking almost any useful Calendly tool produces an auth config that no user can complete.

Five of the derived scope names do not exist

The union over all 52 tools is 17 scopes. Alongside default, these five have no counterpart in Calendly's list:

Returned	Calendly's actual scope
user:read	users:read
user	—
group	groups:read
organization	organizations:read
organization:read	organizations:read

Bare object names without a permission suffix suggest the set is assembled without validation against the provider's published scopes.

Why this is expensive to find

The rejection happens in Calendly's window and never returns to Composio, so no callback is made and the connected account stays INITIATED until it expires ten minutes later with Authorization was started but not completed within 10 minutes. From the API surface it is indistinguishable from a user who walked away — an integrator sees abandoned authorizations, not a toolkit that cannot work.

What would resolve it

Either enroll the Calendly OAuth application in Calendly's scoped permissions so the documented scopes can actually be requested, or derive the scope request from what the application is permitted to send — for this app today that is the unscoped grant.

The five non-existent names are worth correcting independently of that, and it seems worth checking whether other toolkits carry the same shape: a mismatch between derived scopes and what the bundled OAuth app may request is invisible to any check that compares Composio's metadata against itself.