Zoom API Getting Started: Account, Keys, First Request (2026)

Getting started overview

Getting started with the Zoom API involves a sequence of steps to establish developer credentials, configure an application, and execute an initial API request. This process typically includes signing up for a Zoom account, navigating the Zoom Marketplace to create an API application, and understanding the authentication mechanisms required to interact with Zoom’s services Zoom API Rest Reference. The API facilitates integration with core Zoom functionalities, such as managing meetings, users, webinars, and recordings, enabling custom application development and workflow automation.

The primary authentication methods for the Zoom API are OAuth 2.0, including Server-to-Server OAuth, and the legacy JSON Web Token (JWT) method Zoom API Authentication Methods. For new integrations, Zoom recommends OAuth 2.0 for enhanced security and broader scope management. This guide focuses on the recommended approach for new developers seeking to make their first API call.

To ensure a smooth onboarding experience, developers are advised to consult the official Zoom API documentation for the most current information regarding endpoints, authentication flows, and specific API behaviors Zoom Developer Portal.

Quick Reference Steps

Create an account and get keys

The first prerequisite for using the Zoom API is a Zoom account. Developers can use a free Zoom Basic account, which offers access to many API features for development and testing. Once an account is established, the next step is to obtain API credentials through the Zoom App Marketplace.

Account Creation

1. Sign Up/Log In: Go to the Zoom website and either sign in to an existing account or create a new one.
2. Access Developer Portal: Navigate to the Zoom Developer Portal. From there, select "Build App" in the navigation menu to access the app creation interface within the Zoom App Marketplace.

App Creation and Credential Retrieval

Zoom offers different app types, each with specific use cases and authentication flows. For most server-side integrations or applications that manage Zoom resources directly, the Server-to-Server OAuth app type is recommended. For applications requiring user authorization (e.g., users granting an app permission to access their meetings), a standard OAuth app is appropriate Zoom API Authentication Types.

1. Choose App Type: In the Zoom App Marketplace, select "Create" to start a new app. You will be prompted to choose an app type. For this guide, we will assume a Server-to-Server OAuth app for simplicity in demonstrating a direct API call.

2. App Information: Provide a unique name for your application. This name will be visible in the Zoom Marketplace if you choose to publish your app.

3. App Credentials: After creating the app, you will be presented with your Client ID, Client Secret, and Account ID. These are your API credentials. Store these securely, as the Client Secret is only displayed once. For OAuth apps, you will also configure Redirect URLs and Whitelist URLs.

4. Scopes: Define the API scopes your application requires. Scopes determine what your application can do (e.g., meeting:read, user:write). Select only the necessary scopes to adhere to the principle of least privilege Zoom API Scopes Reference.

5. Activate App: After configuring your app, it must be activated. For Server-to-Server OAuth apps, this usually happens automatically upon creation. For OAuth apps, you may need to explicitly activate it.

Your first request

With your application created and credentials obtained, the next step is to make your first authenticated API call. This involves generating an access token and then using that token in an HTTP request to a Zoom API endpoint.

Authenticate with Server-to-Server OAuth

For Server-to-Server OAuth apps, you obtain an access token by making a POST request to Zoom’s OAuth endpoint. This token is valid for a short period (typically 1 hour) and must be refreshed.

curl -X POST "https://oauth.zoom.us/oauth/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=account_credentials&account_id=YOUR_ACCOUNT_ID" \
     --user "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET"

Replace YOUR_ACCOUNT_ID, YOUR_CLIENT_ID, and YOUR_CLIENT_SECRET with your actual credentials. The response will include an access_token, which you will use for subsequent API calls.

Make an API Call

Once you have an access_token, you can use it in the Authorization header of your API requests. Let’s make a simple call to list your account’s users, which requires the user:read:admin scope.

curl -X GET "https://api.zoom.us/v2/users" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -H "Content-Type: application/json"

Replace YOUR_ACCESS_TOKEN with the token obtained from the authentication step. A successful response will return a JSON object containing a list of users associated with your Zoom account. You can also test this using a tool like Postman or Insomnia, configuring the authorization header manually.

Common next steps

After successfully making a first API call, developers typically proceed with integrating more specific functionalities:

• Explore More Endpoints: Review the Zoom API reference documentation to identify other endpoints relevant to your application’s needs, such as creating meetings, managing recordings, or handling webhooks.
• Implement OAuth Flow: If your application interacts with individual user data, implement the full OAuth 2.0 authorization code flow to allow users to grant your application access securely. This is crucial for public or multi-user applications.
• Utilize Webhooks: Set up Zoom Webhooks to receive real-time notifications about events like meeting start/end, user creation, or recording completion. This push-based model reduces the need for constant polling.
• Integrate SDKs: For client-side development (web, mobile, desktop), consider using Zoom’s available Client SDKs (JavaScript, Android, iOS, Windows, macOS, Web) to embed video conferencing functionality directly into your application.
• Error Handling: Implement robust error handling mechanisms to gracefully manage API rate limits, invalid requests, and other potential issues. Consult the Zoom API error codes for specific guidance.
• Security Best Practices: Adhere to security best practices, such as storing API keys securely, encrypting sensitive data, and regularly rotating credentials Google Cloud API Key Best Practices.

Troubleshooting the first call

Encountering issues during the initial API call is common. Here are some troubleshooting steps:

• Incorrect Credentials: Double-check your Client ID, Client Secret, and Account ID. Ensure there are no typos or extraneous spaces. Remember that the client secret is only shown once upon app creation.

• Missing or Incorrect Scopes: Verify that your application has been granted the necessary API scopes for the endpoint you are trying to access. For the "list users" endpoint, user:read:admin is typically required. You can modify scopes in your app settings in the Zoom Marketplace.

• Expired Access Token: Access tokens are short-lived. If you’re receiving an unauthorized error, generate a new access token before making the API request. For production systems, you’ll need to implement a token refresh mechanism.

• Incorrect Endpoint URL: Confirm that the base URL and the specific endpoint path are correct (e.g., https://api.zoom.us/v2/users). Refer to the Zoom API reference for exact endpoint paths.

• HTTP Headers: Ensure that the Authorization header is correctly formatted as Bearer YOUR_ACCESS_TOKEN and that the Content-Type header is set appropriately (e.g., application/json for most requests, application/x-www-form-urlencoded for token requests).

• Rate Limits: While less common for a first call, be aware that Zoom imposes API rate limits. If you’re making multiple rapid requests, you might hit a limit, resulting in a 429 Too Many Requests error.

• Network Issues: Verify your internet connection and ensure no firewalls or proxies are blocking your outbound requests to api.zoom.us or oauth.zoom.us.

• Check Zoom App Status: Ensure your application in the Zoom Marketplace is active and not in a draft or disabled state.