SutrahSign in

For IT / security

Allowlisting Sutrah

Sutrah is a prayer-accommodation tool. Users connect Google Calendar or Outlook so prayer blocks can sit in real free time. This page is the brief to send your admin when workplace OAuth blocks the connection.

Data & scopes

  • Not requested: Gmail, Outlook mail, Drive, OneDrive, Contacts, or chat.
  • Google scope: calendar.events plus basic OpenID profile (account identity).
  • Microsoft scope: Calendars.ReadWrite plus OpenID profile and offline_access for refresh tokens.
  • OAuth tokens are encrypted at rest. Users can disconnect or delete their account; deletion removes prayer events the app wrote when possible.
  • Full policy: Privacy.

Admin actions

  1. Google Workspace: Admin console → Security → Access and data control → API controls → manage app access. Approve Sutrah (or the OAuth client ID your deployer registered) for Calendar.
  2. Microsoft 365 / Entra: Enterprise applications → grant admin consent for the app registration with Calendars.ReadWrite, or allow user consent for that permission.
  3. Confirm the redirect URI matches the deployment: https://sutrah.app/api/auth/callback/google or https://sutrah.app/api/auth/callback/microsoft-entra-id.

Copy-paste request

Users can send this to IT when Connect Google / Outlook is blocked.

Subject: Please allow Sutrah calendar access

Hi,

I use Sutrah (prayer-time accommodation for calendars) at work. Google/Microsoft blocked the connection, which usually means the app needs admin approval.

App: Sutrah
URL: https://sutrah.app
Privacy: https://sutrah.app/privacy
IT brief: https://sutrah.app/for-it

What it needs (calendar only, not email):
• Google: openid, email, profile, https://www.googleapis.com/auth/calendar.events
• Microsoft Graph: openid, email, profile, offline_access, Calendars.ReadWrite

What it does with that access:
• Reads busy/free and event times to place prayer blocks in open slots
• Creates/updates/deletes Sutrah prayer events on my calendar
• Does not request Gmail, Outlook mail, Drive, or Contacts

Please allowlist / grant admin consent for this OAuth app for my account (or the org). Happy to walk through a security review.

Thanks

If access is denied

Users still get prayer times, qibla, planner, and a pull-only ICS/webcal feed. They lose conflict-aware placement until calendar OAuth is approved. The product surfaces that path automatically after a blocked connect attempt.

← Back home