Security and team access

Your connection permissions and team role work together to determine what an assistant can do.

Sedule provides email magic-link and passkey sign-in, plus authenticator-based two-factor setup. Manage passkeys, two-factor settings and connected apps in account security.

Some owner actions, including managing members and public booking credentials, require a passkey or enabled two-factor authentication in addition to the required role and scope.

Review connection permissions

A compatible MCP client opens Sedule’s browser sign-in and consent flow. Review the requesting app, permissions and teams before approving. Decline if the request does not match the access you intend to grant.

sedule:read permits eligible read operations.
sedule:book permits eligible booking changes.
sedule:admin permits administration operations allowed by your team role.

Scopes do not imply one another, and an administrative scope does not turn a staff member into an administrator. A connection may also request offline_access so it can renew access without a new sign-in each time.

Team roles and provider access

Owner: manages ownership-level actions, including team closure and team data export.
Admin: manages services, providers, schedules and permitted member administration, without owner-only powers.
Staff: manages bookings for providers linked or assigned to their membership. Staff cannot administer the team.

Staff may read availability for other providers, which exposes free times rather than customer details. Public booking credentials are a separate, restricted access path; they do not grant team membership or general access to customer records.

Team boundaries

Team-scoped tool calls check membership, role, scopes and the requested resource. Database row-level security and team-scoped relationships add enforcement at the data layer. Being a member of one team does not grant access to another team’s appointments or customer records.

Revoke a connected app

Open account security, find the connected app and revoke its grant. This removes consent and the app’s stored refresh/access-token records, preventing token renewal for that grant.

Already-issued tokens have an expiry

OAuth access tokens already issued can remain usable until they expire. Sedule’s access-token lifetime is 15 minutes; revoking a grant is not an immediate invalidation of every issued token. Team permissions still apply to each call.

A public booking credential is different: a revoked key is refused when it is next authenticated. Do not share credentials or a booking’s manage token in public examples.

Before connecting

Use the connection guide to connect an assistant, then follow team setup and the first-booking guide. Review the permissions before authorizing changes to your schedule.