Zoom Authenticated Bots (ZAK and OBF)

Host one HTTPS token URL, pass it on create_bot, and your Zoom bot joins signed in (ZAK) or on behalf of one of your users (OBF).

MeetStream does not store your users’ Zoom OAuth tokens. You run Zoom OAuth on your server, keep the refresh tokens, and expose a URL that returns a fresh token. At join time, the bot calls that URL and joins with the token it gets back.

Endpoint: POST /api/v1/bots/create_bot Auth: Authorization: Token <your MeetStream API key>

Before you start, save your Meeting SDK app’s Client ID and Client Secret in the dashboard (Zoom Marketplace App Setup). Those credentials are the app the bot runs as. The ZAK or OBF token only says which Zoom user the join is attributed to.

1. Pick a join mode

Since March 2, 2026, Zoom requires Meeting SDK apps that join meetings outside the app’s own Zoom account to be reviewed by Zoom and to use a ZAK or OBF token (Zoom: Meeting SDK authorization, Zoom: OBF FAQ). Meetings hosted by your app’s own Zoom account can still use a guest join.

2. ZAK or OBF?

OBF tokens are short-lived and single-use (Zoom: Transitioning to OBF tokens). Mint one every time MeetStream calls you; never cache or reuse it.

3. How the token fetch works

4. What you host

Two jobs, both on your HTTPS server:

1. OAuth, once per Zoom user. Redirect the user to Zoom’s authorize page, receive the code at your callback, exchange it with POST https://zoom.us/oauth/token (grant_type=authorization_code) and store the refresh token. Never send refresh tokens to MeetStream.
2. The token URL, called on every join. Refresh the user’s access token when needed (grant_type=refresh_token, and save the new refresh token if Zoom returns one), call Zoom’s user token API, and return the token.

Encode which user in the URL (a user_id query parameter, a path segment, or a signed ID) and protect it: MeetStream sends no authentication header and does not sign token requests, so put a secret in the URL (a shared auth query parameter, an HMAC signature, or a short-lived signed URL) and treat the whole URL as a credential.

Minimal token server (Python)

# Minimal example. Replace load_refresh_token/save_refresh_token with your own storage,
# and cache access tokens until they expire in production.
import hmac
import os
import requests
from flask import Flask, abort, jsonify, request
app = Flask(__name__)
CLIENT_ID = os.environ["ZOOM_CLIENT_ID"]
CLIENT_SECRET = os.environ["ZOOM_CLIENT_SECRET"]
URL_SECRET = os.environ["TOKEN_URL_SECRET"]
def require_secret():
    if not hmac.compare_digest(request.args.get("auth", ""), URL_SECRET):
        abort(401)
def zoom_access_token(user_id):
    resp = requests.post(
        "https://zoom.us/oauth/token",
        auth=(CLIENT_ID, CLIENT_SECRET),
        data={"grant_type": "refresh_token", "refresh_token": load_refresh_token(user_id)},
        timeout=10,
    )
    resp.raise_for_status()
    data = resp.json()
    save_refresh_token(user_id, data["refresh_token"])
    return data["access_token"]
def zoom_user_token(user_id, params):
    resp = requests.get(
        "https://api.zoom.us/v2/users/me/token",
        params=params,
        headers={"Authorization": f"Bearer {zoom_access_token(user_id)}"},
        timeout=10,
    )
    resp.raise_for_status()
    return resp.json()["token"]
@app.get("/zoom/zak")
def zak():
    require_secret()
    return jsonify(token=zoom_user_token(request.args["user_id"], {"type": "zak"}))
@app.get("/zoom/obf")
def obf():
    require_secret()
    meeting_number = request.args["meeting_number"]  # added by MeetStream
    return jsonify(
        token=zoom_user_token(
            request.args["user_id"], {"type": "onbehalf", "meeting_id": meeting_number}
        )
    )

jsonify sets Content-Type: application/json, which MeetStream needs to read a JSON response (see Response formats).

5. create_bot examples

Signed in (ZAK)

{
  "meeting_link": "https://zoom.us/j/81234567890?pwd=AbCdEf123",
  "bot_name": "Notetaker",
  "video_required": false,
  "zoom": {
    "zak_url": "https://api.example.com/zoom/zak?user_id=alice&auth=YOUR_URL_SECRET"
  }
}

On behalf of (OBF)

Make sure the authorizing user has joined the Zoom meeting before you create the bot (or before join_at for a scheduled bot). Do not add meeting_number to obf_url.

{
  "meeting_link": "https://zoom.us/j/81234567890?pwd=AbCdEf123",
  "bot_name": "Notetaker",
  "video_required": false,
  "zoom": {
    "obf_url": "https://api.example.com/zoom/obf?user_id=alice&auth=YOUR_URL_SECRET"
  }
}

URL rules checked by create_bot: https only, must include a host, at most 4096 characters, and only on Zoom meetings. The bot calls the URL from the internet, so localhost and private addresses do not work. For local development, expose your server through a public HTTPS tunnel (local webhook server guide).

6. The request MeetStream sends to your URL

When: once per join attempt, right before the bot joins the meeting. For a scheduled bot, that is shortly before join_at. If a join attempt is retried, your URL can be called again for the same bot, so always mint a fresh token.

First request: GET

What the bot does with your GET response

Fallback request: POST

meeting_number in the POST body is a JSON number. Ignore any body fields you do not use. The POST must return 2xx with a usable token, or the join fails.

Response formats

When the fetch fails

The bot does not fall back to a guest join. It ends with status Error and one of these messages, sent as bot.failed with status_code: 500:

• Error: Failed to join meeting: ZAK token is required but could not be fetched
• Error: Failed to join meeting: OBF token is required but could not be fetched

MeetStream fetches the token once per join attempt and does not retry the fetch on its own.

7. Test your URL without a bot

Call your own server the way MeetStream will (replace the host, secret and meeting number):

# ZAK: expect 200 and a long token
curl -sS -D - -H "X-Bot-Id: test-bot" \
  "https://api.example.com/zoom/zak?user_id=alice&auth=YOUR_URL_SECRET"
# OBF: the authorizing user must be in meeting 81234567890 right now
curl -sS -D - -H "X-Bot-Id: test-bot" \
  "https://api.example.com/zoom/obf?user_id=alice&auth=YOUR_URL_SECRET&meeting_number=81234567890"
# POST fallback, if your endpoint only accepts POST
curl -sS -D - -X POST -H "X-Bot-Id: test-bot" -H "Content-Type: application/json" \
  -d '{"bot_id": "test-bot", "meeting_number": 81234567890}' \
  "https://api.example.com/zoom/obf?user_id=alice&auth=YOUR_URL_SECRET"

Check the Content-Type header in the output. Then create a bot with the same URL, without meeting_number on the OBF URL.

8. Troubleshooting

Errors from create_bot (HTTP 400)

Problems at join time

All Zoom statuses and messages are listed in Zoom Meeting Bots and in Bot status and error codes.

Migrating from hosted OBF

MeetStream used to mint ZAK and OBF tokens for you. That flow is retired:

• create_bot rejects zoom.use_zoom_obf and zoom.zoom_oauth_connection_user_id with HTTP 400.
• The hosted token endpoints /api/v1/zoom/zak-token and /api/v1/zoom/obf-token return HTTP 410 Gone with a message telling you to pass zoom.zak_url or zoom.obf_url and mint the token on your server.

To migrate: register your own OAuth redirect URL in your Zoom app (Zoom Marketplace App Setup), have your users authorize your app again through your server, deploy a token URL like the example above, and send zoom.obf_url (or zoom.zak_url) on create_bot.

Related

• Zoom Meeting Bots: admission, recording permission and every Zoom outcome
• Zoom Marketplace App Setup
• Zoom App Production Submission
• Create Bot Payload Reference
• Webhooks and events