App Integrations

Zoom Marketplace App Setup

View as Markdown

MeetStream bots use the Zoom Meeting SDK. App credentials identify the app that runs the bot; a customer’s OAuth grant authorizes access to a Zoom user’s tokens. Configure both for authenticated joins.

1. Create the Meeting SDK app

  1. Sign in to the Zoom App Marketplace.
  2. Choose Develop → Build App → General App.
  3. Choose user-managed or admin-managed permissions to match your integration.
  4. Under Features → Embed, enable Meeting SDK. This is required for OBF.
  5. Copy the app’s Client ID and Client Secret from App Credentials.
  6. Open MeetStream Dashboard → Integrations, select Zoom, and save these credentials.

These Marketplace app credentials are stored on your MeetStream user (integrations auth / zoom) and used by the bot process. Saving them does not create an end-user OAuth grant or supply a ZAK/OBF token.

2. Configure your customer OAuth flow

For ZAK or OBF, run OAuth on your own server:

  1. Register your server’s HTTPS callback, for example https://api.yourapp.com/zoom/oauth/callback, in the Zoom app’s OAuth settings and allow list. Use the exact same redirect URI when authorizing and exchanging the code.
  2. Add the scopes needed for the token you mint: typically user:read:zak for ZAK or user:read:token for OBF. Add user:read:user if you retrieve the Zoom user ID to identify users.
  3. Redirect each Zoom user to authorize your app. Validate OAuth state at your callback and exchange the authorization code with Zoom on your server.
  4. Store the refresh token securely on your server. Refresh access tokens when needed and persist rotated refresh tokens.

MeetStream does not store end-user Zoom OAuth refresh tokens for join. The customer OAuth callback belongs to your server; do not use a MeetStream callback for this flow. Even if one General App provides both capabilities, Meeting SDK app credentials and per-user OAuth grants serve different purposes.

3. Host an HTTPS token mint URL

Your endpoint selects the authorized Zoom user, calls Zoom’s user-token API, and returns the token. Pass the URL, not the token itself, to create_bot:

Join modezoom payload
GuestOmit zoom or send {}
Signed-in user{"zak_url": "https://api.yourapp.com/zoom/zak?user_id=alice&auth=YOUR_SECRET"}
On behalf of a parent user{"obf_url": "https://api.yourapp.com/zoom/obf?user_id=alice&auth=YOUR_SECRET"}

Send only one URL. For OBF, the parent must already be in the meeting. Do not include meeting_number on the URL; MeetStream appends it. Mint OBF tokens when called at join time because they are short-lived and single-use.

The Zoom Authenticated Bots guide includes complete requests, OAuth token APIs, GET/POST behavior, response formats, and troubleshooting. use_zoom_obf and zoom_oauth_connection_user_id are rejected.

4. Test and prepare for production

Test your mint URL first, then call POST /api/v1/bots/create_bot with your chosen join mode. Verify admission and host recording permission separately.

For external meetings, configure the appropriate ZAK or OBF authorization and complete the applicable Zoom app review. Production credentials alone do not replace user authorization or meeting admission rules. See Zoom App Production Submission and Zoom’s Meeting SDK authorization documentation.