iCloud and CalDAV

CalDAV is the open standard most calendars speak. calsync reads and writes these calendars both ways, and they only need an app password, not a sign-in app.

Connect one

Make an app password with your provider, using the list below.
On the calsync page, add a calendar and pick your provider.
Give it a short name, then enter your username and the app password.
Press Check and save, then choose which calendars to sync.

With the command line, run calsync auth caldav LABEL icloud. The other names are fastmail, yahoo, aol, zoho and nextcloud, or give a server address.

Where the password comes from

Apple iCloud: Go to account.apple.com, then Sign-In and Security, then App-Specific Passwords. Your username is your Apple Account email. Your normal Apple password won't work.
Fastmail: Settings, Privacy & Security, then make an app password with Calendars (CalDAV) access. Your username is your Fastmail address.
Yahoo and AOL: Account Security, then generate an app password. Your username is your email address.
Zoho: accounts.zoho.com, Security, App Passwords. Accounts outside the US pick Another CalDAV server and use their own address, such as calendar.zoho.eu.
Nextcloud: Personal settings, Security, Devices & sessions. Enter your Nextcloud address as the server.

Your own server

Pick Another CalDAV server and enter its address. calsync finds your calendars from there. If it can't, try the full CalDAV address:

Nextcloud: https://cloud.example.com/remote.php/dav
Radicale: https://radicale.example.com:5232/
Baikal: https://baikal.example.com/dav.php
SOGo: https://sogo.example.com/SOGo/dav/
Synology: https://nas.example.com:5001/caldav/

calsync only sends a password over https, except to a server on your own network. It also won't follow a redirect to another site with your password.

Calendars with no way in

Proton Calendar has no CalDAV, and an Exchange server you run yourself doesn't speak it. Publish those as a published .ics link, which works one way.

Good to know

Events are copied two ways, the same as Google and Microsoft. Copies carry a hidden tag, and calsync only edits or deletes tagged events.
A calendar you can only read comes through as a source. calsync won't try to write to it.
Reminders lists are left out, since they hold tasks and not events.
If a server throws away calsync's tag, calsync stops writing to that calendar and says so. Turn on Never write to this calendar to keep it as a source.
The app password is stored in the data folder, readable only by its owner. Sign out in calsync, then revoke the app password with your provider, to cut access.