Zoom Authentication: API and SDK Security (2026)

Authentication overview

Zoom's platform requires authentication for accessing its APIs and SDKs, ensuring that only authorized applications and users can interact with Zoom services. This mechanism protects user data, prevents unauthorized access to meetings and account information, and maintains the integrity of the Zoom ecosystem. Developers integrate authentication flows into their applications to manage user sessions, make API calls, and embed Zoom functionalities like video meetings and webinars.

The choice of authentication method depends on the application type and integration requirements. For applications that act on behalf of a Zoom user, such as a scheduling tool that creates meetings in a user's account, an OAuth 2.0 flow is typically used. For server-to-server integrations where an application needs to access data or perform actions without direct user interaction, JSON Web Tokens (JWT) are a common method. Zoom also provides specific authentication mechanisms for its various SDKs, including the Web SDK, Client SDKs, Video SDK, and Meeting SDK, often relying on SDK-specific keys and secrets or OAuth.

Zoom's developer portal provides comprehensive Zoom API documentation outlining the steps for each authentication method, including obtaining credentials, implementing the authentication flow, and handling tokens and refresh mechanisms. Adhering to these guidelines and general security best practices is essential for building secure and reliable applications that integrate with Zoom.

Supported authentication methods

Zoom supports several authentication methods tailored for different integration scenarios, ranging from web applications to server-side services and native mobile applications. The primary methods include OAuth 2.0 and JSON Web Tokens (JWT) for API access, alongside SDK-specific keys and secrets for embedding Zoom features directly into applications.

OAuth 2.0

OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to an HTTP service, either on behalf of a resource owner or by orchestrating an approval interaction between the resource owner and the HTTP service OAuth 2.0 specification. Zoom uses OAuth 2.0 for applications that require user consent to access their Zoom account data or perform actions on their behalf. This is suitable for web applications, mobile apps, and desktop applications where a user explicitly grants permissions.

• Authorization Code Grant: This is the most common and secure OAuth flow for confidential clients (applications that can securely store a client secret, like server-side web applications). It involves redirecting the user to Zoom for authorization, receiving an authorization code, and then exchanging that code for an access token and refresh token from the application's backend.
• PKCE (Proof Key for Code Exchange): Recommended for public clients (applications that cannot securely store a client secret, like mobile apps and single-page applications). PKCE adds an additional layer of security by using a dynamically created secret for each authorization request, mitigating interception attacks PKCE RFC 7636.

JSON Web Tokens (JWT)

JWT is a compact, URL-safe means of representing claims to be transferred between two parties JWT.io documentation. Zoom uses JWT for server-to-server integrations where an application needs to access Zoom APIs without specific user interaction. This is ideal for backend services, cron jobs, or integrations that manage Zoom resources independently of individual user sessions. JWTs are signed using a secret key, ensuring their authenticity and integrity. They typically have a short expiration time, requiring applications to generate new tokens as needed.

SDK-Specific Authentication

Zoom's various SDKs (Web, Client, Video, Meeting) often use dedicated keys and secrets for initialization and authentication. These credentials link the embedded Zoom functionality to your developer account, enabling features like creating and joining meetings within your application. The specific implementation details vary by SDK but generally involve providing an SDK Key and SDK Secret during the SDK initialization process.

The table below summarizes Zoom's primary authentication methods:

Getting your credentials

To authenticate with Zoom's APIs or SDKs, you must first create an application on the Zoom Developer Portal. The type of application you create dictates the credentials you will receive.

OAuth App Credentials

1. Create an OAuth App: Navigate to the Developer Portal, log in, and select 'Build App'. Choose 'OAuth' as the app type.
2. Configure App Details: Provide a name, select app type (User-managed or Account-managed), and configure redirect URLs.
3. Obtain Client ID and Client Secret: After creating the app, Zoom will provide a 'Client ID' and 'Client Secret'. These are unique identifiers for your application. The Client Secret must be kept confidential and never exposed in client-side code.
4. Set Scopes: Define the necessary permissions (scopes) your application requires to access user data or perform actions.

JWT App Credentials

1. Create a JWT App: From the Developer Portal, choose 'Build App' and select 'JWT'.
2. Obtain API Key and API Secret: Upon creation, Zoom will provide an 'API Key' and 'API Secret'. The API Key identifies your application, and the API Secret is used to sign your JWTs. The API Secret is highly sensitive and must be securely stored on your server.

SDK App Credentials

1. Create an SDK App: In the Developer Portal, select 'Build App' and choose the appropriate SDK type (e.g., 'Meeting SDK').
2. Obtain SDK Key and SDK Secret: Zoom will generate an 'SDK Key' and 'SDK Secret' for your application. These credentials are used to initialize the respective Zoom SDK within your application code. Depending on the SDK, the secret might be used to generate a signature for meeting sessions.

Always treat your API secrets, client secrets, and SDK secrets as highly confidential. Never hardcode them directly into publicly accessible codebases, such as client-side JavaScript or mobile applications without proper obfuscation and secure delivery mechanisms. Instead, retrieve them from a secure backend or environment variables.

Authenticated request example

This example demonstrates how to make an authenticated API request using a JSON Web Token (JWT) for a server-to-server integration. This method is common for backend services that need to interact with the Zoom API without direct user involvement. The JWT needs to be generated using your API Key and API Secret obtained from the Zoom Developer Portal.

JWT Generation (Python Example)

import jwt
import datetime

API_KEY = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"

def generate_jwt_token():
    header = {
        "alg": "HS256",
        "typ": "JWT"
    }
    payload = {
        "iss": API_KEY,
        "exp": datetime.datetime.now(tz=datetime.timezone.utc) + datetime.timedelta(minutes=30)
    }
    return jwt.encode(payload, API_SECRET, algorithm="HS256", headers=header)

# Example usage:
jwt_token = generate_jwt_token()
print(f"Generated JWT: {jwt_token}")

API Request (Python Example with Requests Library)

After generating the JWT, you include it in the Authorization header of your API request as a Bearer token.

import requests

def get_zoom_user_info(user_id, jwt_token):
    headers = {
        "Authorization": f"Bearer {jwt_token}",
        "Content-Type": "application/json"
    }
    response = requests.get(f"https://api.zoom.us/v2/users/{user_id}", headers=headers)
    response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)
    return response.json()

# Example usage:
try:
    # Replace with a valid Zoom user ID (e.g., 'me' for the owner of the API key)
    user_data = get_zoom_user_info("me", jwt_token)
    print("User Info:")
    print(user_data)
except requests.exceptions.HTTPError as err:
    print(f"HTTP error occurred: {err}")
except Exception as err:
    print(f"An error occurred: {err}")

This example retrieves information about the user associated with the API key. For OAuth 2.0, the process would involve obtaining an access token through the OAuth flow and then using that access token similarly in the Authorization: Bearer header.

Security best practices

Implementing robust security measures is critical when integrating with Zoom's authentication mechanisms. Adhering to these best practices helps protect user data, prevent unauthorized access, and maintain the integrity of your application and Zoom services.

• Secure Credential Storage:
  • Never hardcode API Keys, API Secrets, Client IDs, Client Secrets, or SDK Secrets directly into your source code, especially for client-side applications.
  • Store secrets in environment variables, secure configuration files, or dedicated secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault).
  • For client-side SDKs, use server-side generation for critical credentials or signatures to minimize exposure.
• OAuth 2.0 Best Practices:
  • Always use the Authorization Code Grant flow with PKCE for public clients (mobile, SPAs) to prevent authorization code interception OAuth PKCE documentation.
  • Configure strict redirect URIs in your Zoom app settings. Only allow specific, trusted URLs to receive authorization codes.
  • Implement CSRF protection for your OAuth redirect endpoints.
  • Securely store refresh tokens, encrypting them at rest if possible, and ensure they are only accessible by your backend.
  • Rotate refresh tokens regularly if supported by your implementation.
• JWT Best Practices:
  • Keep your API Secret strictly confidential. Any party with this secret can generate valid tokens.
  • Set short expiration times (exp claim) for JWTs, typically 30 minutes to 1 hour, to limit the window of opportunity for token misuse if intercepted.
  • Implement server-side token revocation if your application requires immediate invalidation of access.
  • Ensure that the JWT library you use is up-to-date and correctly handles signing and verification.
• Least Privilege Principle:
  • Request only the necessary API scopes (permissions) for your application. Avoid requesting broad permissions if your application only needs a subset.
  • Regularly review the granted permissions for your applications on the Zoom Developer Portal.
• Error Handling and Logging:
  • Implement robust error handling for authentication failures and API responses.
  • Log authentication attempts and failures for auditing and anomaly detection, but avoid logging sensitive credential information.
• Regular Security Audits:
  • Periodically review your application's authentication implementation and credential management for vulnerabilities.
  • Stay informed about security updates and recommendations from Zoom and the broader security community.
• HTTPS/TLS Everywhere:
  • Always use HTTPS for all communication involving sensitive data, including authentication requests and API calls, to protect against eavesdropping and man-in-the-middle attacks.
• Developer Account Security:
  • Enable two-factor authentication (2FA) on your Zoom developer account to add an extra layer of security against unauthorized access to your credentials.