Connect Google Calendar
OAuth — Google doesn’t offer a personal-API-key path for Calendar, so this is a one-click flow rather than a paste-in token.Authorise on Google
Pick the Google account you want Forepost to schedule into. The permissions screen lists exactly what we’ll access: read your calendar’s free/busy times, and create events on your primary calendar.
How → Calendar works
On any pending action in the Daily Brief, click → Calendar:- Forepost calls Google
freeBusyfor your primary calendar over the next 5 working days. - Walks forward 30 mins at a time, skipping weekends, before-9am, and after-6pm slots, until it finds a free 30-min slot.
- Parses a name from the action text where possible — “Coach Sarah” → event title
1:1: Sarah. If no name pattern matches, the event is titled Forepost action follow-up with the full action text in the description. - Creates the event on your primary calendar. Returns the start time and a link to open in Google Calendar.
Optional: invite an attendee
ThePOST /actions/:id/calendar API accepts { attendeeEmail: "..." } to add an attendee. The SPA doesn’t surface this yet; you can hit the API directly if you need it. The default is a no-attendee event (a held slot for yourself).
What Forepost does NOT do
- No calendar reads beyond freeBusy. We never read event content, attendees, or your colleagues’ calendars.
- No cross-calendar scheduling. Only your primary calendar. If you keep work events on a secondary calendar, that’s a future affordance.
- No timezone smarts. Slots are picked in UTC working hours (9-6). For most users that’s fine; if your day starts at 8am local time, edit the event after creation.
- No undo. Created events live in Google. If Forepost picks a slot you don’t want, delete the event directly in Google Calendar — Forepost doesn’t track what it scheduled.
Disconnecting
Settings → Integrations → Google Calendar → Disconnect. The encrypted access + refresh tokens are deleted immediately. Already-created events stay in Google. To fully revoke, also remove Forepost from your Google account’s authorised apps at https://myaccount.google.com/permissions.Privacy
Forepost stores only the OAuth access token (1h lifetime) and refresh token, both AES-GCM encrypted with the worker’s key. We never see or persist event content. Every Calendar call is on-demand at the moment you click → Calendar. Required scopes:calendar.events— create events on your primary calendarcalendar.freebusy— read busy ranges (no event details) to find a free slotuserinfo.email— display “Connected as kian@…” in Settings