I found the best way to do this
- Make the event secret
- to hide the link from my home page
- Use the “let link expire after the first booking” option
- so the link is only useful to the first person who uses it
- change the event url to a UUID4 (option 5 above)
- I didn’t find this setting at first because the scheduling link isn’t an editable text field
- but you can go to edit → more options → booking page options to edit the url
- generate a UUID4 locally so only you have the unique ID, then never share it with anyone
- only use the one time link option
This combination of settings means that the only way a person can book a meeting with me is if they are the first person to use a link I made. There’s no way for anyone to use a link a second time or guess the link of the main scheduling page, which satisfies my personal security requirements.
As a side note, I figured out how calendly generates the scheduling link in the first place, but that information isn’t needed because you can just edit the link after it’s generated.
I’ll explain how calendly generates the meeting link for documentation anyway.
- The first link name is the length of time of the meeting, so calendly.com/username/30m would be the link for the first 30 minute meeting I make.
- If I make another 30 minute meeting, calendly spells out the time to avoid a collision with the first link, ie calendly.com/username/30-minutes (it’s something like that, I don’t have the exact spelling right).
- Then, all 30 minute meetings I make after that just use the title of the meeting, so a meeting titled “Meeting with Jacob” comes up as calendly.com/username/meeting-with-jacob (note the hyphens and lowercasing)
- Then, if I make another meeting with the title “Meeting with Jacob”, the link just increments, calendly.com/username/meeting-with-jacob-1
Update:
- it looks like even the one time link includes the meeting link, making it possible for an adversary to find my main booking page
- so I will generate the uuid4 locally every time I share a link
- this is inconvenient but preferable to me over giving adversaries a way to book a meeting with me