Authentication and authorization

On-Call Optimizer uses only OAuth and OIDC. There is no username and password sign-in.

It asks only for the OAuth permissions a given action needs, following incremental authorization. You can use different providers without granting On-Call Optimizer a broad set of permissions.

Permissions requested at login

On-Call Optimizer requests an OIDC login flow from the authentication provider requesting the OIDC standard email and profile grants. On-Call Optimizer stores the email and name returned in the provided ID token.

When you sign in with a Google Workspace or Microsoft work account, On-Call Optimizer also stores the ID, name and primary domain of that workspace or organization, so it can link your account to an On-Call Optimizer organization. Microsoft accounts need the User.Read permission for this, because the ID token doesn’t include it.

All other information available to On-Call Optimizer during the login process is discarded. In particular, once the login process has completed, On-Call Optimizer does not retain or store the access or refresh tokens provided by the OIDC login flow.

Permissions requested when connecting a calendar

When connecting to a calendar provider, On-Call Optimizer uses a standard OAuth 2.0 authorization code flow to obtain a read-only access token, along with an offline access (refresh) token so it can keep reading your calendar.

Permissions requested when connecting an on-call product

On-Call Optimizer uses API tokens for access to any configured on-call product schedules. A read-only API token is supported when an on-call product is used as a source for an On-Call Optimizer schedule. A read-write API token is required when an on-call product is a destination for a schedule.

Permissions requested when connecting to Slack

When the On-Call Optimizer Slack app is installed for a Slack Workspace, On-Call Optimizer receives an OAuth 2.0 access and refresh token which are used to access the Slack API. The following scopes are required for the On-Call Optimizer Slack app:

• app_mentions:read - to allow the app to receive app_mention notifications, so it can reply when someone mentions it.
• channels:read, groups:read, im:read - to allow the app to receive member_joined_channel and member_left_channel events so it can track the channels it has been invited to, and so it can call conversations.info to read those channels’ names. On-Call Optimizer only receives these events and requests information for channels which it has been invited to join.
• chat:write - to allow the app to send messages to channels using the chat.postMessage and chat.postEphemeral API requests. On-Call Optimizer only sends messages in response to a command request or to deliver a configured notification.
• im:history - to allow the app to receive message.im notifications when a user directly interacts with the app from the messages tab of the App Home surface. On-Call Optimizer does not make any API requests using this scope.
• reactions:read, reactions:write - so the app can call the reactions.* API and react to a command to show the status of its reply. On-Call Optimizer does not read or write reactions on any other messages.

Permissions summary

[0]: The OIDC protocol includes the offline access scope by default, however On-Call Optimizer does not retain the provided refresh (or access) tokens, so no offline access is available to On-Call Optimizer, even though the permissions screen seen by the user indicates it may be.

[1]: Refer to the calendar provider for details on the specific scope name: Google, Outlook