Zoom API Authentication: Methods, Setup, and Security (2026)

Authentication overview

Authentication for the Zoom API grants applications the necessary permissions to interact with Zoom's services programmatically. This process verifies the identity of the application and, in some cases, the end-user, ensuring that only authorized requests are processed. The choice of authentication method depends on the type of application being built and the scope of access required. Applications designed to perform actions on behalf of individual Zoom users typically use OAuth 2.0, while applications needing account-level access without user intervention often utilize Server-to-Server OAuth. Zoom has transitioned its primary authentication recommendations, with JWT (JSON Web Token) authentication being deprecated in favor of OAuth 2.0 variants for enhanced security and manageability.

The Zoom API documentation provides detailed guidance on implementing each authentication flow, including setting up applications in the Zoom App Marketplace, managing API keys and secrets, and handling token lifecycles. Proper authentication is a prerequisite for making successful API calls to manage meetings, webinars, users, reports, and other Zoom resources, as outlined in the Zoom API Rest Reference.

Supported authentication methods

The Zoom API supports several authentication methods, each suited for different integration scenarios:

• OAuth 2.0: This is the recommended method for applications that require user-specific authorization. It allows users to grant third-party applications limited access to their Zoom account without sharing their credentials directly. OAuth 2.0 is an industry-standard protocol for authorization, detailed by the OAuth 2.0 specification. Zoom implements various OAuth flows, including Authorization Code Grant, suitable for web applications, and Implicit Grant, for client-side applications.
• Server-to-Server OAuth: Introduced as a replacement for JWT authentication, Server-to-Server OAuth is designed for applications that need to interact with the Zoom API at an account level, without a specific user's interaction. This method is ideal for backend services, daemon applications, or integrations that manage Zoom resources across an entire organization. It involves generating an access token using client credentials and a certificate, providing a secure way for server-side applications to authenticate.
• JWT (JSON Web Token): Historically, JWT was a common method for server-to-server integrations. However, Zoom has announced the deprecation of JWT app types, with a full transition to Server-to-Server OAuth recommended for new applications and existing integrations. While still functional for legacy applications, developers are advised to migrate to more current methods for improved security and compliance. JWTs are compact, URL-safe means of representing claims to be transferred between two parties, as described in RFC 7519.

Authentication Method Comparison

Getting your credentials

To obtain the necessary credentials for authenticating with the Zoom API, developers must register an application in the Zoom App Marketplace. The process typically involves these steps:

1. Create a Developer Account: Sign up for a Zoom account and access the Developer Portal.
2. Navigate to the Zoom App Marketplace: From the Developer Portal, select "Build App."
3. Choose an App Type: Select the appropriate app type based on your authentication needs:
   • OAuth: For applications requiring user-specific permissions. This will provide a Client ID and Client Secret, and you will configure Redirect URLs.
   • Server-to-Server OAuth: For applications requiring account-level permissions. This will provide an Account ID, Client ID, and Client Secret.
   • JWT: (Legacy) For existing applications using JWT, you would have an API Key and API Secret. New applications are strongly advised to use Server-to-Server OAuth instead.
4. Configure App Details: Provide essential information about your application, including its name, description, privacy policy URL, and authorized redirect URLs (for OAuth apps).
5. Set Scopes: Define the specific permissions your application needs. Scopes limit the access an application has to a user's or account's data and actions (e.g., meeting:read, user:write). Carefully selecting only necessary scopes adheres to the principle of least privilege, enhancing security.
6. Activate and Publish: After configuration, activate your app. Depending on the app type and intended audience, you may need to submit it for review and publication in the Zoom App Marketplace.

Upon successful app creation, the necessary credentials (Client ID, Client Secret, Account ID, etc.) will be displayed in your app's dashboard within the Marketplace. These credentials are confidential and should be stored securely and never hardcoded into client-side applications.

Authenticated request example

The following example demonstrates how to make an authenticated request using Server-to-Server OAuth to list Zoom users. This method is suitable for backend services.

Step 1: Obtain an Access Token

First, obtain an access token by making a POST request to Zoom's OAuth token endpoint. Replace YOUR_ACCOUNT_ID, YOUR_CLIENT_ID, and YOUR_CLIENT_SECRET with your actual credentials from the Zoom App Marketplace.

curl -X POST \
  'https://zoom.us/oauth/token?grant_type=account_credentials&account_id=YOUR_ACCOUNT_ID' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Authorization: Basic '$(echo -n 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' | base64)

The response will contain an access_token and its expires_in duration. This token must be refreshed before it expires.

Step 2: Make an API Request with the Access Token

Once you have the access token, include it in the Authorization header of your API requests as a Bearer token. This example lists users in a Zoom account.

curl -X GET \
  'https://api.zoom.us/v2/users' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json'

Replace YOUR_ACCESS_TOKEN with the token obtained in Step 1. The API will respond with a list of users associated with the authenticated account, demonstrating successful authentication and authorization.

Security best practices

Implementing robust security practices is critical when integrating with the Zoom API:

• Use OAuth 2.0 or Server-to-Server OAuth: Prioritize these methods over JWT for new integrations due to their enhanced security features, including token refresh mechanisms and better credential management.
• Principle of Least Privilege: Configure your application with only the necessary Zoom API scopes. Granting excessive permissions increases the risk in case of a breach.
• Secure Credential Storage: Never hardcode API keys, client IDs, or client secrets directly into your application code, especially in client-side applications. Store them securely in environment variables, secret management services (e.g., AWS Secrets Manager, Google Secret Manager), or secure configuration files.
• Rotate Credentials: Regularly rotate your client secrets and other API credentials. This practice limits the window of exposure if credentials are compromised.
• Validate Webhooks: If your application consumes Zoom webhooks, always verify the authenticity of webhook payloads using the provided signature. This prevents spoofing and ensures that data originates from Zoom. The Zoom webhook security guide provides details on signature verification.
• Implement Token Refresh: For OAuth-based authentications, implement proper access token and refresh token handling. Access tokens have a limited lifespan; use refresh tokens to obtain new access tokens without re-authenticating the user.
• Error Handling and Logging: Implement comprehensive error handling for API authentication failures and log relevant security events. This aids in detecting and responding to potential unauthorized access attempts.
• HTTPS Everywhere: Ensure all communication with the Zoom API occurs over HTTPS to encrypt data in transit and protect against eavesdropping and man-in-the-middle attacks.
• Regular Security Audits: Periodically review your application's security posture, including its authentication mechanisms and access controls, to identify and mitigate vulnerabilities.