Zoom Video SDK Authentication: Methods and Security (2026)

Authentication overview

Zoom Video SDK employs an authentication model designed to secure access to its video communication services and ensure that only authorized applications and users can initiate or join video sessions. The core of this system relies on the use of JSON Web Tokens (JWTs) for server-side authentication and SDK App credentials for client-side initialization. This dual approach helps maintain security by separating the generation of session tokens from the direct exposure of sensitive API keys to end-user devices.

Developers integrate Zoom Video SDK by first creating an SDK App in the Zoom Marketplace. This process provides the necessary SDK Key and SDK Secret, which are essential for generating JWTs. These tokens grant temporary, scoped access to the Video SDK's functionalities. The JWT model ensures that applications authenticate with Zoom's backend services before a client application can connect to a video session. This architecture prevents unauthorized access and helps manage resource usage efficiently.

The authentication flow typically involves a server-side component responsible for generating the JWT using the SDK Key and Secret, and a client-side component that receives this token and uses it to join a video session. This separation of concerns is a standard security practice in API design, minimizing the risk of credential compromise. For an overview of how JWTs function, refer to the JWT documentation.

Supported authentication methods

Zoom Video SDK primarily supports token-based authentication, specifically JSON Web Tokens (JWTs), for authorizing access to its services. This method ensures secure communication between your application and the Zoom backend.

JSON Web Token (JWT)

JWTs are the primary method for authenticating server-side requests with the Zoom Video SDK. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a Zoom Video SDK JWT specify the SDK App Key, the access token's expiration time, and the specific session name. Your backend server generates these tokens using your SDK App credentials (SDK Key and SDK Secret) and then passes them to your client-side application. The client-side application uses this JWT to initialize the SDK and join video sessions.

SDK App Credentials

While not a direct authentication method in the sense of being sent with every API call, your SDK Key and SDK Secret are the foundational credentials used to sign and generate JWTs. These are obtained from the Zoom Marketplace when you create an SDK App. The SDK Key identifies your application, and the SDK Secret is used to cryptographically sign the JWT, verifying its authenticity and integrity. It is crucial to keep your SDK Secret confidential and never expose it on the client side.

The following table summarizes the primary authentication components:

Getting your credentials

To begin using the Zoom Video SDK, you must obtain your SDK App credentials (SDK Key and SDK Secret) from the Zoom Marketplace. These credentials are vital for generating the JSON Web Tokens (JWTs) that authenticate your application with Zoom's services.

1. Access the Zoom App Marketplace: Navigate to the Zoom App Marketplace and log in with your Zoom account.
2. Create a New SDK App: In the Marketplace, select the "Develop" dropdown menu and choose "Build App." You will be prompted to select an app type; choose "SDK" and then "Server-side App." This choice is crucial because it ensures your SDK Secret is securely managed on your backend server.
3. Configure App Details: Provide a name for your SDK App and fill in the required basic information, including company name and developer contact details.
4. Retrieve Credentials: After creating the app, navigate to the "App Credentials" tab. Here, you will find your unique SDK Key and SDK Secret. Copy these values immediately and store them securely. The SDK Secret is only displayed once, so ensure you save it.
5. Activate Your App: Ensure your SDK App is activated in the Marketplace. An inactive app cannot be used to generate valid tokens or access the Video SDK.

These credentials allow your server to generate JWTs, which your client applications will then use to authenticate with the Zoom Video SDK. For detailed steps on creating an SDK App, refer to the Zoom Video SDK Get Started guide.

Authenticated request example

The core of Zoom Video SDK authentication involves generating a JWT on your backend server and then passing that token to your client-side application. The client application then uses this JWT to initialize the SDK and join a video session. Below is an example of how a JWT can be generated using Node.js, and subsequently, how it's used on the client-side (JavaScript for Web SDK).

Server-side JWT Generation (Node.js)

This example uses the jsonwebtoken library to create a JWT. Replace YOUR_SDK_KEY and YOUR_SDK_SECRET with your actual credentials from the Zoom Marketplace.

const jwt = require('jsonwebtoken');

const generateZoomVideoSdkToken = (sessionName, roleType) => {
  const sdkKey = 'YOUR_SDK_KEY';
  const sdkSecret = 'YOUR_SDK_SECRET';
  const iat = Math.floor(Date.now() / 1000); // Issued at time
  const exp = iat + 60 * 60 * 2; // Expiration time (2 hours from now)

  const payload = {
    app_key: sdkKey,
    iat: iat,
    exp: exp,
    tpc: sessionName, // Topic/session name
    role_type: roleType, // 1 for host, 0 for attendee
  };

  const token = jwt.sign(payload, sdkSecret, { algorithm: 'HS256' });
  return token;
};

// Example usage:
// const mySessionToken = generateZoomVideoSdkToken('my-video-session', 1); // Host role
// console.log(mySessionToken);

In a production application, your backend would expose an API endpoint that your client-side application calls to retrieve this generated token.

Client-side SDK Initialization (Web SDK - JavaScript)

Once your client application receives the JWT from your backend, it uses this token to initialize the Zoom Video SDK and join a session.

import { ZoomVideoSDK } from '@zoom/videosdk';

const initializeVideoSDK = async (sessionToken, sessionName, userName) => {
  const client = ZoomVideoSDK.createClient();

  try {
    await client.init('en-US', 'Global', {
      videoSDKJWT: sessionToken,
      // Other initialization options like disableVideo, disableAudio, etc.
    });
    console.log('Zoom Video SDK initialized successfully.');

    // Join the session
    const stream = client.getStream();
    await stream.join(sessionName, userName);
    console.log(`Joined session: ${sessionName} as ${userName}`);

    // You can now access video/audio streams and other SDK features
  } catch (error) {
    console.error('Failed to initialize or join session:', error);
  }
};

// Example usage (assuming 'sessionToken' is fetched from your backend):
// const fetchedSessionToken = 'eyJhbGciOiJIUzI1Ni...'; // Token from your server
// initializeVideoSDK(fetchedSessionToken, 'my-video-session', 'John Doe');

This example demonstrates the typical flow: server generates a secure, time-limited token, and the client uses it to establish a connection. For more client-side examples across different SDKs, refer to the Zoom Video SDK Web Getting Started guide.

Security best practices

Implementing security best practices is crucial when integrating Zoom Video SDK to protect your application, user data, and prevent unauthorized access. The following recommendations align with general API security principles and Zoom's guidelines:

1. Keep SDK Secrets Confidential: Your SDK Secret is a critical credential used to sign JWTs. Never embed it directly in client-side code (web, mobile apps) or expose it in publicly accessible repositories. It should only reside on your secure backend server.
2. Generate JWTs Server-Side: Always generate your Zoom Video SDK JWTs on a secure backend server. This prevents the exposure of your SDK Secret. Your client application should request a token from your server, rather than generating it itself.
3. Short-Lived JWTs: Configure your JWTs with a short expiration time (exp claim). Zoom recommends a maximum of two hours. If a token is compromised, its utility to an attacker is limited by its short lifespan.
4. Validate User Access on Your Backend: Before generating a Zoom Video SDK JWT for a user, your backend should perform its own authentication and authorization checks. Ensure that the user requesting the token is genuinely authorized to participate in the specified video session.
5. Implement Rate Limiting: Apply rate limiting to the API endpoint on your backend that generates JWTs. This can help mitigate brute-force attacks or abuse where an attacker attempts to rapidly generate tokens.
6. Secure Communication (HTTPS/WSS): Ensure all communication between your client application and your backend (for token retrieval) uses HTTPS. The Zoom Video SDK itself communicates over secure WebSockets (WSS).
7. Regularly Rotate Credentials: Periodically rotate your SDK Key and Secret. If a key is compromised, rotating it minimizes the window of vulnerability. You can generate new credentials in the Zoom Marketplace.
8. Error Handling and Logging: Implement robust error handling for token generation and SDK initialization. Log authentication failures securely on your backend to detect potential malicious activity. Avoid verbose error messages on the client side that could leak sensitive information.
9. Stay Updated: Keep your Zoom Video SDK versions up to date. Updates often include security patches and improvements. Regularly check the Zoom Video SDK release notes for important announcements.
10. Principle of Least Privilege: Grant only the necessary permissions and roles to users joining sessions. For example, assign a 'host' role only when truly required.
11. Environment Variables for Credentials: When deploying your backend, use environment variables or a secure secret management system (e.g., AWS Secrets Manager, Google Secret Manager) to store your SDK Secret, rather than hardcoding it in your application code. This practice is detailed in guides like the Google Cloud secret management documentation.

By adhering to these practices, you can significantly enhance the security posture of your applications built with the Zoom Video SDK.