Zoom
zoom.us · Video conferencing / meetings · for: AI agent reads the user's meetings, recordings and transcripts and schedules meetings on their behalf.
Have a Zoom owner/admin grant you the 'Zoom for developers' role, then create a user-managed General app at marketplace.zoom.us and complete Local Test on your own account. Start the privacy, terms, support and docs pages plus the Technical Design write-up the same week, because Marketplace review, not the code, is the critical path.
Your path at a glance
Watch out for
- BlockerNo external customers until review (Unlisted is still reviewed)why & fix →
- WarningBeta sharing is heavyweight and cappedwhy & fix →
- WarningServer-to-Server OAuth won't work for a multi-customer productwhy & fix →
- WarningAI training on Zoom content is prohibited by defaultwhy & fix →
- WarningRotating refresh tokens can strand userswhy & fix →
- WarningRate limits are per customer account and shared with every other appwhy & fix →
- InfoTranscripts may simply not existwhy & fix →
- InfoAdding scopes after launch means re-review and re-consentwhy & fix →
Before you start
- Zoom account with developer rolewhy →
- Free-account sanctions compliancebusiness / legalwhy →
- Public policy and support pages on your own domainbusiness / legalwhy →
- DNS or web-root access for domain verificationwhy →
- HTTPS redirect and webhook endpointswhy →
- Security documentationbusiness / legalwhy →
- Customer plan supports recordings and transcriptscustomer's adminwhy →
Steps
Configure OAuth
Review & verification
Copy & paste
user:read:usermeeting:read:list_meetingsmeeting:read:meetingmeeting:write:meetingcloud_recording:read:list_user_recordingscloud_recording:read:list_recording_filescloud_recording:read:meeting_transcript- Developer console
- https://marketplace.zoom.us/
- OAuth docs
- https://developers.zoom.us/docs/integrations/oauth/
- Authorize URL
- https://zoom.us/oauth/authorize
- Token URL
- https://zoom.us/oauth/token
- Discovery
- https://zoom.us/.well-known/oauth-authorization-server
Show prompt
You are implementing a Zoom integration for our AI agent, which reads a user's meetings, cloud recordings and transcripts and schedules meetings for them. Constraints from Zoom's official docs:
1. App type: Zoom Marketplace 'General app', User-managed (not Server-to-Server). Authorization-code flow: GET https://zoom.us/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&state=..., then POST https://zoom.us/oauth/token (HTTP Basic client_id:client_secret, x-www-form-urlencoded grant_type=authorization_code, code, redirect_uri).
2. Access tokens expire after 1 hour. Refresh tokens expire after 90 days and rotate, so on every grant_type=refresh_token call atomically persist the NEW refresh_token, and use a per-user lock so two workers never refresh concurrently. On invalid_grant, mark the connection as needing reconnect.
3. Use API base https://api.zoom.us/v2 (also returned as api_url in the token response). Endpoints (confirm each path and its rate-limit label in the Zoom Meeting API reference before coding): GET /users/me; GET /users/me/meetings; GET /meetings/{meetingId}; POST /users/me/meetings; GET /users/me/recordings; GET /meetings/{meetingId}/recordings; the 'Get a meeting transcript' endpoint (look up its exact path in the Zoom Meeting API reference; do not guess). Granular scopes: user:read:user meeting:read:list_meetings meeting:read:meeting meeting:write:meeting cloud_recording:read:list_user_recordings cloud_recording:read:list_recording_files cloud_recording:read:meeting_transcript.
4. Rate limits are per customer account and shared with all their apps (Free: Medium 2/s and 2000/day; Pro: 20/s; Business+: 60/s). Meeting create/update is capped at 100 per user per day. Handle 429 with backoff and prefer webhooks over polling.
5. Implement an app_deauthorized webhook endpoint that verifies Zoom's signature with the webhook secret token, then deletes all stored data and tokens for that user.
6. Never use Zoom Customer Content (recordings, transcripts, chat) for model training, evaluation or fine-tuning. Add a code comment and a config guard so transcripts are only sent to LLM endpoints configured with no-training and no-retention.
7. Handle missing transcripts gracefully (they exist only if cloud recording and 'Create audio transcript' are enabled).
Also: write a smoke-test script that exercises each endpoint with a token from Local Test, generate .env.example, and draft (a) user documentation covering adding, using and removing the app and what data is deleted on removal, and (b) a Marketplace reviewer test plan with step-by-step instructions per scope. Do not invent URLs; leave TODO markers where a value must come from the Zoom console.Show dotenv
# Zoom General app (User-managed), from marketplace.zoom.us > your app > App Credentials # Development credentials: Local Test on your own account only ZOOM_CLIENT_ID=your_development_client_id ZOOM_CLIENT_SECRET=your_development_client_secret # Production credentials: used for the first review submission and after publishing # ZOOM_CLIENT_ID=your_production_client_id # ZOOM_CLIENT_SECRET=your_production_client_secret ZOOM_REDIRECT_URI=https://app.example.com/oauth/zoom/callback ZOOM_AUTHORIZE_URL=https://zoom.us/oauth/authorize ZOOM_TOKEN_URL=https://zoom.us/oauth/token ZOOM_API_BASE=https://api.zoom.us/v2 # Secret token from the app's webhook/event subscription settings, used to verify app_deauthorized events ZOOM_WEBHOOK_SECRET_TOKEN=your_webhook_secret_token # Granular scopes are configured in the console. Listed here for documentation and tests. ZOOM_SCOPES="user:read:user meeting:read:list_meetings meeting:read:meeting meeting:write:meeting cloud_recording:read:list_user_recordings cloud_recording:read:list_recording_files cloud_recording:read:meeting_transcript"
Show typescript
// Zoom refresh tokens rotate: always persist the new refresh_token.
export async function refreshZoomToken(userId: string, db: TokenStore) {
return db.withUserLock(userId, async () => {
const current = await db.get(userId);
if (current.expiresAt - Date.now() > 5 * 60_000) return current; // still fresh
const basic = Buffer.from(`${process.env.ZOOM_CLIENT_ID}:${process.env.ZOOM_CLIENT_SECRET}`).toString("base64");
const res = await fetch("https://zoom.us/oauth/token", {
method: "POST",
headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: current.refreshToken }),
});
if (!res.ok) {
await db.markNeedsReconnect(userId, await res.text());
throw new Error(`Zoom refresh failed: ${res.status}`);
}
const t = await res.json(); // { access_token, refresh_token, expires_in, scope, api_url }
const next = { accessToken: t.access_token, refreshToken: t.refresh_token, expiresAt: Date.now() + t.expires_in * 1000, scope: t.scope, apiUrl: t.api_url };
await db.save(userId, next); // same critical section as the refresh call
return next;
});
}Show markdown
# <App name> - Zoom Marketplace test plan ## Test credentials - Our service: reviewer@example.com / <password> (role: standard user) - Second role (if any): <...> ## 1. Authorize 1. Log in at https://app.example.com and click 'Connect Zoom'. 2. Approve the consent screen (Production Client ID). ## 2. Scope-by-scope walkthrough | Scope | Feature | Steps | Expected result | |---|---|---|---| | meeting:read:list_meetings | Upcoming meetings panel | ... | ... | | meeting:write:meeting | 'Schedule with agent' | ... | Meeting appears in Zoom | | cloud_recording:read:list_user_recordings | Recordings list | ... | ... | | cloud_recording:read:meeting_transcript | Meeting summary | ... | ... | ## 3. Remove the app - Zoom Marketplace > Manage > Added Apps > Remove. We receive app_deauthorized and delete all stored data within <N> hours. ## Demo video (optional) - <Loom link>
Why & details
The reasoning, evidence and sources behind everything above. Hover a badge to see its sources.
The full picture
Self-serve, review to scale
OAuth credentials for a user-managed General app are instant and work on your own Zoom account in under an hour, but no external Zoom account may use the app until it passes Zoom's mandatory Marketplace functional + security review (even 'Unlisted' apps are reviewed), so budget days of prep and one to several weeks of review. Zoom's API Terms also forbid using Customer Content obtained via the API (recordings, transcripts) to train or fine-tune AI models without Zoom's written permission or the account owner's explicit consent.
Anyone with the 'Zoom for developers' role can create a General app and get development credentials immediately, and Local Test adds it to their own account. Distribution to other Zoom accounts is gated: private apps are limited to your own account, beta sharing outside it needs Zoom approval and is capped/time-boxed, and broad third-party use requires publishing through Marketplace review (listed or unlisted). It is not tenant-scoped: one app and one set of endpoints serve every customer account.
Rating: Audits, partner approval or multi-week reviews that you can't speed up.
Your Zoom user has the 'Zoom for developers' role (or is owner/admin). You have created a user-managed General app, set the redirect URL and allow list, added granular scopes, and used Local Test > Add App Now with the development credentials to complete the code exchange on your own account.
The app is published (Listed or Unlisted) after the functional and security review. This requires a complete listing, policy/support/docs URLs on your domain, verified domains, a Technical Design section, a test plan with test credentials, the production client ID used in the submission, and fixes for any review notes. Zoom publishes no total timeline. Forum staff cite a 72-business-hour SLA per functional-review response and 'up to 2 weeks' for security review, but developers report multi-round reviews taking 1 to 3+ months. The active minutes are our estimate.
What affects your setup
- Manual app review
Published apps (Listed or Unlisted) go through Zoom's review: submission completeness, branding, functionality/usability/compliance, then Marketplace security review. The API Terms (s.6.1) only permit Third Party Use if the app is published on the Marketplace or Zoom approves it in writing.
- Security assessment
Zoom's own security team reviews your Technical Design section and tests the app against the OWASP Top 10 and least-privilege scopes. This is Zoom-run, not a paid third-party assessment like CASA. Separately, getting a beta authorization URL approved requires SSDLC docs, SAST and DAST scan output, and 3 of 5 artifacts such as a pen-test summary.
- Policy URLs required
Privacy Policy, Terms of Use, Support URL and user Documentation URL (adding/using/removing the app) are required, and they must be hosted on an FQDN your company owns. Google Drive and Dropbox links are rejected.
- Domain verification
One-time, account-wide verification of the domains of your Privacy Policy, Terms, OAuth redirect, webhook and Home URLs, done with a TXT record, an HTML file, a meta tag, or a manual request to Zoom support.
- User cap until approved
Before publication, external users can only be added through an approved beta authorization URL. It is valid for 4 weeks plus up to two 4-week extensions, capped at 100 additions for user-level apps (10 for account-level), and you may not publicise the app while it is active.
- Customer admin consent
A customer's Marketplace admin can require apps to be pre-approved before users can add them; users then send a request to the admin. Admin-managed apps and ':admin' scopes must be authorized by a user with account-level permissions.
- Redirect URI rules
The redirect URL must match one registered in the app and appear in the OAuth allow list. Confidential (non-PKCE) apps must use HTTPS redirects. Loopback redirects are only for PKCE/native clients, must use 127.0.0.1 or [::1] (not 'localhost'), and are matched ignoring the port.
- Token lifecycle gotchas
Access tokens last 1 hour. Refresh tokens last 90 days and are rotated, so every refresh returns a new refresh_token you must persist. Adding scopes requires users to re-authorize. Published apps get an app_deauthorized webhook and must then delete the user's data.
Before you start — why each matters
- Zoom account with developer role — The account owner, an admin, or a user granted 'Zoom for developers' (View and Edit) under User Management > Roles. The Developer menu does not appear otherwise.
- Free-account sanctions compliance — Developers on a Free Zoom account must upgrade to 'Free with Credit Card' or submit Zoom's developer-information form before publishing.
- Public policy and support pages on your own domain — Privacy Policy, Terms of Use, Support URL (with hours and first-response SLA) and user Documentation (add, use and remove the app, plus data handling on removal), all on an FQDN you own.
- DNS or web-root access for domain verification — Needed to add a TXT record, upload an HTML file, or add a meta tag for each domain used in your app's URLs.
- HTTPS redirect and webhook endpoints — A production HTTPS redirect URL plus an endpoint for app_deauthorized events, verified with Zoom's webhook secret token.
- Security documentation — The Technical Design section (architecture, security controls, data use per scope) is required for review. Beta URL sharing additionally needs SSDLC docs, SAST and DAST output, and 3 of 5 policy or pen-test artifacts.
- Customer plan supports recordings and transcripts — End users' accounts need a Pro, Business, Education or Enterprise plan with cloud recording on and 'Create audio transcript' enabled, or no transcripts will exist to read.
How well this guide is backed
Step details
Your users authorize access to their own meetings and recordings, so create a General app with 'User-managed' management. Server-to-Server OAuth issues tokens only for your own account (account_credentials, no end-user consent) and is meant for internal apps. Admin-managed apps act account-wide and must be added by the customer's admin. Changing the management type later forces you to reconfirm features and scopes.
👤 Why you: A product/business judgement only you can make
🤖 What an agent can do: Summarise the trade-offs of user-managed vs admin-managed vs S2S for your product and recommend one, citing the Before You Start doc.
https://developers.zoom.us/docs/build-flow/before-you-build/ ↗Sign in to marketplace.zoom.us, open Develop > Build an app, choose General app, rename it, and select User-managed. Copy the Development Client ID and Secret into your secret store. Production credentials are separate and are used when you submit for review.
👤 Why you: Needs your logged-in console session (2FA/CAPTCHA)
🤖 What an agent can do: Generate the .env template and a secrets checklist that keeps development and production client IDs separate.
https://marketplace.zoom.us/ ↗Enter the HTTPS OAuth Redirect URL, add it (and any other callback URLs) to the OAuth allow list, and optionally enable Strict Mode. Under Scopes, add only the granular scopes you use (user:read:user, meeting:read:list_meetings, meeting:read:meeting, meeting:write:meeting, cloud_recording:read:list_user_recordings, cloud_recording:read:list_recording_files, cloud_recording:read:meeting_transcript). Write a description for each; mark non-essential ones optional.
👤 Why you: Needs your logged-in console session (2FA/CAPTCHA)
🤖 What an agent can do: Map each product feature to the exact Zoom endpoint and granular scope from the Granular Scopes reference, and draft the per-scope justification text for the console and the review.
https://developers.zoom.us/docs/integrations/create/ ↗Redirect to https://zoom.us/oauth/authorize with a state parameter. Exchange the code at https://zoom.us/oauth/token using HTTP Basic auth. Refresh before the 1-hour expiry, and atomically save the new refresh_token returned on every refresh, since refresh tokens last 90 days and rotate. Handle app_deauthorized webhooks by verifying them and deleting the user's data. Back off on HTTP 429.
🤖 What an agent can do: Write the callback route, encrypted token storage, a per-user refresh lock, a webhook signature verifier, and the deletion job. Add a 429 retry with backoff.
https://developers.zoom.us/docs/integrations/oauth/ ↗In the Development tab, open Local Test > Add App Now > Allow to authorize your own account. Then call GET /v2/users/me, list meetings, create a test meeting, and fetch a recording and transcript from a meeting recorded to the cloud with audio transcript enabled.
👤 Why you: Needs your logged-in console session (2FA/CAPTCHA)
🤖 What an agent can do: Write a smoke-test script that exercises every scoped endpoint and records its output. That output can seed the reviewer test plan.
https://developers.zoom.us/docs/integrations/create/ ↗Complete the App Listing (short description of 150 characters or fewer, long description, 2-3 screenshots at 1200x780), Privacy, Terms, Support and Documentation URLs on your own domain, and the Technical Design section. Write a test plan (document or Loom video) with step-by-step instructions and test login credentials for your service.
👤 Why you: Legal attestation, payment, or contract
🤖 What an agent can do: Draft the user documentation (add, use and remove the app, plus data deletion), the support page, the listing copy, the Technical Design data-flow description, and the reviewer test plan from your codebase.
https://developers.zoom.us/docs/distribute/app-submission/common-rejection-issues/ ↗In Production > Publish your app > App Submission, verify each domain (TXT record, HTML file, meta tag, or manual request). Make sure the test environment authorizes with the Production Client ID for a first ('Create') submission. Choose the audience (External Zoom users), add release notes with the test-plan link, accept the Marketplace Developer Agreement, and submit.
👤 Why you: DNS or domain ownership change
🤖 What an agent can do: Generate the DNS TXT record change or the HTML verification file for deployment, and switch the deployed config to the production client ID and secret.
https://developers.zoom.us/docs/distribute/app-submission/submit-apps-review/ ↗Zoom reviews submission completeness, branding, functionality, usability, compliance and then security (OWASP Top 10, least-privilege scopes). You must respond to or acknowledge every reviewer note before resubmitting. Rejected apps receive a report and can be resubmitted.
👤 Why you: Waiting on the provider's reviewers
🤖 What an agent can do: Triage each reviewer note into a code or docs fix, apply the fixes, and draft concise replies. Add the OWASP security response headers Zoom's build-flow docs recommend.
https://developers.zoom.us/docs/distribute/app-review-process/ ↗After approval, the app activates immediately or waits for you to click Activate, depending on what you chose. Unlisted apps are hidden from Marketplace search and installed through your authorization URL. You can switch between Listed and Unlisted at any time without another review.
👤 Why you: A product/business judgement only you can make
🤖 What an agent can do: Wire the 'Connect Zoom' button to the production authorization URL and add monitoring for token-refresh failures and 429s.
https://developers.zoom.us/docs/build-flow/app-listing/eu-and-discoverability/ ↗If the customer's account requires pre-approval of Marketplace apps, users see a 'request' flow instead of being able to add your app. Their owner or admin approves it under Manage approvals or App requests, for all users or for specific users or groups. For transcripts, the customer's admin, or the user if the setting isn't locked, must enable cloud recording and 'Create audio transcript'.
👤 Why you: Your customer's admin must act
🤖 What an agent can do: Write a customer-facing admin guide covering how to pre-approve the app and enable cloud recording plus audio transcripts, linking Zoom's support articles.
https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062300 ↗
Gotchas explained
- BlockerNo external customers until review (Unlisted is still reviewed)
Development and private apps work only for users in your own Zoom account. 'Unlisted' only hides the app from search; it still needs the full review and listing metadata. The API Terms allow Third Party Use only for Marketplace-published apps or with Zoom's written approval.
Fix: Start the listing, policy pages and Technical Design work in parallel with development, and submit as soon as core flows work. Plan design-partner pilots around the beta URL limits.
- WarningBeta sharing is heavyweight and capped
Sharing a beta authorization URL outside your account requires a 'Request to Share' approval (about 3-4 business days). You must supply SSDLC docs, SAST and DAST output, a privacy policy, and 3 of 5 security artifacts. The URL is valid 4 weeks plus two extensions, with at most 100 user-level additions, and you cannot publicise the app meanwhile.
Fix: Only use beta if you need external pilots before publication. Otherwise go straight to Marketplace submission; the beta security docs are not a prerequisite for publishing.
- WarningServer-to-Server OAuth won't work for a multi-customer product
S2S apps use account_credentials for your own account only, with no end-user consent and no refresh token. They cannot read other companies' meetings.
Fix: Use a user-managed General app with the authorization-code flow. Keep S2S only for internal admin tooling on your own account.
- WarningAI training on Zoom content is prohibited by default
The API Terms ban using Customer Content obtained via the APIs (recordings, transcripts, chat) to train, evaluate or improve AI/ML models, or allowing others to do so, without Zoom's written permission. With explicit account-owner consent, any resulting model may serve only that customer.
Fix: Use transcripts for inference only. Make sure your LLM vendor contract has no-training and zero-retention terms, never add Zoom data to shared fine-tuning or eval sets, and state this in your privacy policy and Technical Design.
- WarningRotating refresh tokens can strand users
Every refresh returns a new refresh_token, which lasts 90 days. If you lose the new value (for example in a race between two workers), the user must re-authorize.
Fix: Serialise refreshes per user with a lock, persist the new token in the same transaction, and prompt reconnection on invalid_grant.
- WarningRate limits are per customer account and shared with every other app
Limits apply at the account level and are shared by all apps installed on that account. Free accounts also have daily caps (e.g. 2000/day for Medium APIs), and meeting create/update is capped at 100 per user per day.
Fix: Use webhooks for data-change events instead of polling (Zoom's own recommendation), cache meeting lists, and handle 429 with backoff using the response headers for daily-limit resets. Cap the number of meetings your agent can create per day.
- InfoTranscripts may simply not exist
Audio transcripts are generated only for cloud recordings on Pro/Business/Education/Enterprise accounts with 'Create audio transcript' enabled, and admins can lock the setting off.
Fix: Detect missing transcripts and tell the user which setting to enable. Optionally fall back to transcribing the audio file yourself, which is inference, not training.
- InfoAdding scopes after launch means re-review and re-consent
New scopes on a published app need a review before they take effect in Production, and existing users must re-authorize after scope changes.
Fix: Request every scope your roadmap needs in the first submission, using optional scopes for non-core features.
Why each scope
| Scope | Why you need it | Tier | Evidence |
|---|---|---|---|
user:read:user | GET /v2/users/me: identify the connected Zoom user (id, email, timezone) for account linking. | basic | |
meeting:read:list_meetings | List the user's scheduled and upcoming meetings. | basic | |
meeting:read:meeting | Read details of a single meeting (agenda, time, join URL). | basic | |
meeting:write:meeting | Create meetings on the user's behalf (scheduling). Updates and deletes need separate meeting:update and meeting:delete scopes if required. | basic | |
cloud_recording:read:list_user_recordings | List the user's cloud recordings. | sensitive | |
cloud_recording:read:list_recording_files | Get a meeting's recording files, including download URLs for MP4/M4A and transcript (VTT) files. | sensitive | |
cloud_recording:read:meeting_transcript | Get a meeting transcript through the dedicated Get a meeting transcript endpoint. | sensitive |
Reference facts
- Authorize / token endpointshttps://zoom.us/oauth/authorize (302 to sign-in) and https://zoom.us/oauth/token (Basic auth; bogus client returns 400 invalid_client)
- Token lifetimesAccess token 1 h (expires_in 3600). Refresh token 90 days, rotated on every refresh. Server-to-Server tokens have no refresh token.
- PKCE / discoveryPKCE supported via a separate public client ID (S256). RFC 8414 metadata is served at /.well-known/oauth-authorization-server.
- Who can install before reviewOnly users in your own Zoom account (Local Test or a private authorization URL). External users need an approved beta URL (4 weeks, max 100 user-level additions) or a published app.
- Review timelineNot published. Staff on the forum cite a 72-business-hour SLA per functional round and up to 2 weeks for security review; real cases take weeks to months.
- Rate limits (per customer account, shared by all apps)Light/Medium/Heavy APIs: Free 4/s, 2/s, 1/s with daily caps (6000, 2000, 1000). Pro 30/s, 20/s, 10/s. Business+ 80/s, 60/s, 40/s. Meeting create/update is capped at 100 per user per day (UTC).
- AI training restrictionAPI Terms (updated 16 Jul 2025): Customer Content obtained via Zoom APIs may not be used to train, evaluate or improve AI/ML models, LLMs included, without Zoom's written permission. With the account owner's explicit consent, it may only train a model used by that customer.
- Developer prerequisites'Zoom for developers' role (or owner/admin) to build. Free-account developers must add a credit card or submit a sanctions-compliance form before publishing.
- PKCE (from discovery document)Advertised methods: S256
- Endpoints observed liveAuthorize: HTTP 302; redirects to zoom.us/oauth/signin; → endpoint is live (client validation may happen after login) · Token: HTTP 400; error "invalid_client"; → token endpoint is live and rejects a bogus code
What we verified — and what we couldn't
Live probes (no credentials)
- ✓discovery
https://zoom.us/.well-known/oauth-authorization-serverHTTP 200; issuer https://zoom.us; authorize https://zoom.us/oauth/authorize; PKCE methods: S256[P1] - ✓authorize
https://zoom.us/oauth/authorizeHTTP 302; redirects to zoom.us/oauth/signin; → endpoint is live (client validation may happen after login)[P2] - ✓token
https://zoom.us/oauth/tokenHTTP 400; error "invalid_client"; → token endpoint is live and rejects a bogus code[P3] - ✓page
https://marketplace.zoom.us/HTTP 200; title "App Marketplace"[P4] - ✓page
https://developers.zoom.us/docs/integrations/oauth/HTTP 200; title "OAuth 2.0 - Integrations - Zoom Developer Docs"[P5]
Open questions
- How long will the Marketplace review actually take?Zoom's docs publish no duration ('varies based on app quality'). The only figures come from Zoom staff on the developer forum (72-business-hour SLA per functional-review response, security review 'up to 2 weeks'), and real threads show multi-round reviews lasting weeks to months.To resolve: Submit early with a thorough test plan, then ask on devforum.zoom.us in the Marketplace > Submission category for a status estimate once you are in security review.
- Does sending Zoom transcripts to a third-party LLM for inference comply with the API Terms?The AI clause bans AI Training (train, develop, evaluate, test, improve or modify models), or allowing data to be used for it. It does not explicitly address inference by a sub-processor, and the Terms also restrict disclosing Personal Information to third parties except contracted service providers.To resolve: Have counsel review the Zoom API License and Terms of Use (updated 16 Jul 2025) against your LLM vendor's data-processing terms. Describe the LLM data flow explicitly in the Technical Design section so the reviewers can raise objections before approval.
- Will reviewers push back on recording and transcript scopes?Zoom does not label granular scopes by sensitivity. The security review only says it verifies 'minimum necessary' scopes and may ask you to remove some.To resolve: Justify each recording and transcript scope with a concrete user-facing feature in the scope descriptions and test plan, and make non-core ones optional.
- Is admin pre-approval on by default for business customers?Zoom's support article explains how admins approve apps and how users request approval, but it doesn't state the default setting or which plans it applies to.To resolve: Test installs with a few pilot customers' accounts after publishing, and keep an admin-approval help page ready.
- Is Zoom's OIDC discovery document supported for third-party apps?https://zoom.us/.well-known/openid-configuration returned 200 with openid, email and profile scopes, but none of the Zoom docs we read mention OIDC or ID tokens.To resolve: Don't rely on ID tokens. Identify users with GET /v2/users/me (user:read:user) unless Zoom documents OIDC.
Ask the provider
A ready-to-send message built from the open questions above.
- Send to
- Zoom Developer Forum (Marketplace > Submission category, monitored by Zoom staff); for beta authorization-URL questions, email integration.testers@zoom.us — https://devforum.zoom.us/
- Subject
- OAuth integration questions — Zoom
Hi Zoom developer support team,
We're building an integration where AI agent reads the user's meetings, recordings and transcripts and schedules meetings on their behalf. Before we register an OAuth app and launch to customers, we couldn't find answers to the following in your documentation:
1. How long will the Marketplace review actually take?
(What we found: Zoom's docs publish no duration ('varies based on app quality'). The only figures come from Zoom staff on the developer forum (72-business-hour SLA per functional-review response, security review 'up to 2 weeks'), and real threads show multi-round reviews lasting weeks to months.)
2. Does sending Zoom transcripts to a third-party LLM for inference comply with the API Terms?
(What we found: The AI clause bans AI Training (train, develop, evaluate, test, improve or modify models), or allowing data to be used for it. It does not explicitly address inference by a sub-processor, and the Terms also restrict disclosing Personal Information to third parties except contracted service providers.)
3. Will reviewers push back on recording and transcript scopes?
(What we found: Zoom does not label granular scopes by sensitivity. The security review only says it verifies 'minimum necessary' scopes and may ask you to remove some.)
4. Is admin pre-approval on by default for business customers?
(What we found: Zoom's support article explains how admins approve apps and how users request approval, but it doesn't state the default setting or which plans it applies to.)
5. Is Zoom's OIDC discovery document supported for third-party apps?
(What we found: https://zoom.us/.well-known/openid-configuration returned 200 with openid, email and profile scopes, but none of the Zoom docs we read mention OIDC or ID tokens.)
Could you point us to the right documentation or process — including whether any review or approval is needed before customers outside our own account can connect, and the typical timeline?
Thanks,
[Your name]
[Company · website]Sources
- S1Zoom Developer Docs - OAuth 2.0 (integrations)official
- S2Zoom Developer Docs - Create a General appofficial
- S3Zoom Developer Docs - Before you start (management models, app types, distribution)official
- S4Zoom Developer Docs - Distribute your appofficial
- S5Zoom Developer Docs - Submit apps for reviewofficial
- S6Zoom Developer Docs - App review processofficial
- S7Zoom Developer Docs - Sharing private and beta appsofficial
- S8Zoom Developer Docs - EU and discoverability (Unlisted apps)official
- S9Zoom Developer Docs - Common reasons for app submission rejectionofficial
- S10Zoom Developer Docs - Granular scopes referenceofficial
- S11Zoom Developer Docs - Rate limitsofficial
- S12Zoom Developer Docs - Server-to-Server OAuthofficial
- S13Zoom Developer Docs - Internal apps (Server-to-server)official
- S14Zoom Developer Docs - End user authorization (pre-approval, deauthorization)official
- S15Zoom Support - Pre-approving and approving apps in Zoom App Marketplaceofficial
- S16Zoom API License and Terms of Use (Last Updated July 16, 2025)official
- S17Zoom Support - Enabling or disabling audio transcription for cloud recordingsofficial
- S18Zoom Changelog - Granular and optional scopes releasedofficial
- S19Zoom Developer Docs - Migrate from classic to granular scopesofficial
- S20Zoom Developer Forum - Marketplace App Production Approval Timelines Post Updates (Nov 2025)community
- S21Zoom Developer Forum - Zoom Security Review Approximated Time (Jun 2024)community
- S22Zoom Developer Forum - Zoom app approval timeline (Sep-Dec 2025)community
- S23Zoom Developer Docs - Verify your domainsofficial
- T1Probe: GET authorize endpoint with client_id=probe-invalid (2026-10-28)probe
- T2Probe: POST token endpoint with bogus client and code (2026-10-28)probe
- T3Probe: GET OAuth authorization-server and OpenID discovery metadata (2026-10-28)probe
- P1Our probe: discovery check on zoom.usprobe
- P2Our probe: authorize check on zoom.usprobe
- P3Our probe: token check on zoom.usprobe
- P4Our probe: page check on marketplace.zoom.usprobe
- P5Our probe: page check on developers.zoom.usprobe