Zoom Getting Started: Account Setup & First API Call (2026)

Getting started overview

Getting started with the Zoom API involves a sequence of steps designed to prepare your application for communication with Zoom's services. This process typically begins with establishing a Zoom account, which is a prerequisite for accessing the developer portal. Once an account is secured, developers proceed to register an application within the developer environment. This registration is crucial for generating the necessary API credentials, such as client IDs and secrets for OAuth 2.0 or API keys and secrets for JWT authentication, which are used to authorize API requests. Configuring appropriate scopes or permissions for your application ensures it can access only the required resources, adhering to the principle of least privilege. The subsequent step involves choosing an authentication method and implementing it in your code to obtain an access token. With a valid access token, your application can then make its first programmatic call to a Zoom API endpoint, retrieving or manipulating data according to the granted permissions. This foundational setup enables integration of Zoom's video conferencing, meeting management, and other communication features into custom software solutions, enhancing collaboration capabilities.

For a quick reference, the table below outlines the essential steps to get started:

Create an account and get keys

To begin using the Zoom API, an active Zoom account is required. You can start with a Basic (Free) Zoom account, which offers limited functionality but is sufficient for initial API exploration and testing. For more extensive use cases, including longer meeting durations or additional features, a paid plan such as Pro, Business, or Enterprise may be necessary, each available through Zoom's pricing page. Once your account is established, navigating to the Zoom Developer Portal is the next critical step. This portal is the central hub for managing your applications and API credentials.

Within the Developer Portal, you will need to create a new application. Zoom offers several application types, including OAuth, JWT, and SDK apps. For most API integrations, OAuth or JWT apps are suitable. OAuth 2.0 is recommended for user-specific actions and integrations that require user consent, while JWT (JSON Web Token) is often used for server-to-server integrations where the application acts on its own behalf without direct user interaction for each request. When creating an OAuth app, you will be provided with a Client ID and Client Secret. For JWT apps, an API Key and API Secret are generated. These credentials are vital for authenticating your API requests and should be stored securely, treated like passwords, and never exposed in client-side code or public repositories. The Zoom guide on creating apps provides detailed instructions for each app type, including setting redirect URLs for OAuth and configuring scopes.

When selecting the authentication method, consider the type of integration you are building. OAuth 2.0 is an industry-standard protocol for authorization and is detailed by the OAuth 2.0 specification. It involves a multi-step flow where users grant your application permission to access their Zoom data. JWT authentication, on the other hand, involves creating a signed token that includes your API Key and Secret, which is then sent with each API request. The Zoom API Authentication documentation provides specific examples and best practices for both methods, including how to generate and refresh access tokens.

Your first request

After successfully obtaining your API credentials and understanding your chosen authentication method, the next step is to make your first API request. This involves generating an access token and then using it to call a Zoom API endpoint. We will demonstrate a simple example using the List Users API endpoint, which typically requires a valid access token and appropriate scopes.

OAuth 2.0 Flow (Server-side applications)

For OAuth, you first need to obtain an authorization code by redirecting the user to Zoom's authorization URL. After the user grants permission, Zoom redirects them back to your specified redirect URL with the authorization code. You then exchange this code for an access token and a refresh token.

Example: Requesting an Access Token with OAuth (using Python with requests)

import requests
import base64

CLIENT_ID = "YOUR_CLIENT_ID"
CLIENT_SECRET = "YOUR_CLIENT_SECRET"
AUTH_CODE = "AUTHORIZATION_CODE_FROM_REDIRECT"
REDIRECT_URI = "YOUR_REDIRECT_URI"

# Encode Client ID and Secret for Basic Auth header
client_auth = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()

token_url = "https://zoom.us/oauth/token"
headers = {
    "Authorization": f"Basic {client_auth}",
    "Content-Type": "application/x-www-form-urlencoded"
}
data = {
    "grant_type": "authorization_code",
    "code": AUTH_CODE,
    "redirect_uri": REDIRECT_URI
}

response = requests.post(token_url, headers=headers, data=data)
token_data = response.json()
ACCESS_TOKEN = token_data.get("access_token")

print(f"Access Token: {ACCESS_TOKEN}")

# Now, make a call to the List Users API
if ACCESS_TOKEN:
    api_url = "https://api.zoom.us/v2/users"
    api_headers = {
        "Authorization": f"Bearer {ACCESS_TOKEN}",
        "Content-Type": "application/json"
    }
    user_response = requests.get(api_url, headers=api_headers)
    print("List Users API Response:")
    print(user_response.json())

JWT Flow (Server-to-server applications)

For JWT, you construct a JWT using your API Key and Secret, sign it, and then include it directly in the Authorization header of your API request. No separate token exchange is needed.

Example: Making a Request with JWT (using Python with PyJWT)

import jwt
import datetime
import requests

API_KEY = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"

def generate_jwt_token(api_key, api_secret):
    expiration_time = datetime.datetime.utcnow() + datetime.timedelta(minutes=30)
    payload = {
        "iss": api_key,
        "exp": int(expiration_time.timestamp())
    }
    encoded_jwt = jwt.encode(payload, api_secret, algorithm="HS256")
    return encoded_jwt

jwt_token = generate_jwt_token(API_KEY, API_SECRET)

print(f"JWT Token: {jwt_token}")

# Make a call to the List Users API
api_url = "https://api.zoom.us/v2/users"
api_headers = {
    "Authorization": f"Bearer {jwt_token}",
    "Content-Type": "application/json"
}

response = requests.get(api_url, headers=api_headers)
print("List Users API Response:")
print(response.json())

Remember to replace placeholders like YOUR_CLIENT_ID, YOUR_CLIENT_SECRET, AUTHORIZATION_CODE_FROM_REDIRECT, YOUR_REDIRECT_URI, YOUR_API_KEY, and YOUR_API_SECRET with your actual credentials. The Zoom List Users API documentation provides details on required scopes and expected responses.

Common next steps

After successfully making your first API call to Zoom, several common next steps can further enhance your integration. These steps typically involve exploring additional API endpoints, implementing Webhooks for real-time event notifications, and preparing your application for production deployment.

• Explore More API Endpoints: The Zoom API REST Reference provides a comprehensive list of available endpoints. Common areas to explore include managing meetings (Meeting API), managing users (User API), and handling webinars (Webinar API). Depending on your application's needs, you might integrate features like scheduling meetings, adding participants, or retrieving meeting recordings.

• Implement Webhooks: For real-time updates and event-driven architectures, Zoom Webhooks are essential. Webhooks allow Zoom to notify your application when specific events occur, such as a meeting starting, a participant joining, or a recording completing. This eliminates the need for constant polling and reduces API call volume. The Zoom Webhooks documentation explains how to set up webhook subscriptions and verify incoming requests. For secure webhook handling, consider implementing signature verification, a common practice described in general webhook security guides like Stripe's.

• Review Rate Limits: Be aware of Zoom's API rate limits to prevent your application from being throttled. The Zoom API Rate Limits documentation details the number of requests allowed per minute or day for different endpoints. Implement exponential backoff and retry mechanisms in your code to handle rate limit errors gracefully.

• Error Handling: Implement robust error handling for all API calls. The Zoom API returns standard HTTP status codes and detailed error messages in JSON format. Refer to the Zoom HTTP Status Codes reference for a list of common errors and their meanings.

• Production Deployment Considerations: Before moving to production, ensure your application adheres to Zoom's Marketplace Guidelines if you plan to list it publicly. Also, review security best practices for storing API keys and secrets, implement proper access control, and ensure your application's architecture can scale. Regularly review your application's scopes to ensure it requests only the necessary permissions.

• Explore SDKs: If you're building client-side applications (web, desktop, mobile), consider using Zoom's various SDKs (Software Development Kits) like the Web SDK, Meeting SDK, or Video SDK. These SDKs provide pre-built UI components and simplified interfaces for integrating Zoom functionalities directly into your application, often reducing development time and complexity compared to raw REST API calls for certain features.

Troubleshooting the first call

Encountering issues during your first API call is common. Here's a guide to troubleshooting typical problems:

• Invalid Credentials (401 Unauthorized):

  • Cause: Incorrect Client ID/Secret, API Key/Secret, or expired/invalid access token.
  • Solution: Double-check your credentials in the Zoom Developer Portal. Ensure you are using the correct credentials for the chosen app type (OAuth vs. JWT). For OAuth, verify the access token generation process and its expiration time. For JWT, ensure the token is correctly signed and the expiration time is valid (within 30 minutes for JWT).

• Missing or Incorrect Scopes (403 Forbidden):

  • Cause: Your application doesn't have the necessary permissions (scopes) to access the requested API endpoint.
  • Solution: Go to your application settings in the Zoom Developer Portal, navigate to the 'Scopes' section, and add the required scopes for the API endpoint you are trying to call. For example, to call the List Users API, you typically need the user:read scope. If it's an OAuth app, users might need to re-authorize your application after scope changes.

• Invalid Request Parameters (400 Bad Request):

  • Cause: The request body or URL parameters are malformed, missing required fields, or contain invalid values.
  • Solution: Refer to the specific Zoom API endpoint documentation for the correct request format, required parameters, and data types. Use a tool like Postman or Insomnia to test request bodies before integrating into your code. Analyze the error message returned by Zoom, which often provides clues about the specific invalid parameter.

• Rate Limit Exceeded (429 Too Many Requests):

  • Cause: Your application has sent too many requests within a short period, exceeding Zoom's API rate limits.
  • Solution: Implement exponential backoff and retry logic in your code. Review the Zoom API Rate Limits documentation to understand the specific limits for the endpoints you are using. Design your application to make fewer, more efficient calls where possible, or batch requests if the API supports it.

• Network or Connectivity Issues:

  • Cause: Problems with your internet connection, firewall, or DNS resolution preventing your application from reaching Zoom's API servers.
  • Solution: Verify your network connection. If operating behind a firewall or proxy, ensure that outbound connections to api.zoom.us on HTTPS (port 443) are allowed. Check DNS resolution for Zoom's API domain.

• Incorrect API Endpoint URL:

  • Cause: You might be using an outdated, malformed, or incorrect base URL for the API.
  • Solution: Always use https://api.zoom.us/v2/ as the base URL for the REST API. Double-check the path for the specific endpoint you are calling against the Zoom API Reference.

When troubleshooting, always check the exact HTTP status code and the error message provided in the API response, as Zoom's error messages are often descriptive and can pinpoint the problem.