Setting Up a Zoom App

This guide walks through creating a Zoom app on the Zoom App Marketplace. You will use this app to either:

• Use SDK credentials for internal meetings (no OBF tokens needed)
• Implement OAuth for OBF tokens when joining external meetings

Prerequisites

• A Zoom account (free or paid works)
• Access to the Zoom App Marketplace

Creating Your Zoom App

Active Apps Notifier (AAN) Attribution

When a bot joins a Zoom meeting using the Meeting SDK, Zoom displays the app name in the Active Apps Notifier (AAN) — a notice visible to all meeting participants showing which apps are accessing meeting content. The app name shown is determined by the SDK credentials used to initialize the session.

How It Works

The AAN displays the app name associated with whichever SDK credentials are used for the session:

• With your SDK credentials (zoom_sdk_id / zoom_sdk_pwd): The AAN shows your app name
• Without SDK credentials: The bot falls back to Meeting BaaS's default SDK credentials, and the AAN shows "Meeting Baas"

Using SDK Credentials with OBF Tokens

If your bots join external meetings (requiring OBF tokens), you should also pass your SDK credentials to ensure correct AAN attribution. The SDK credentials and OBF tokens serve different purposes:

• SDK credentials → Control the AAN app name (your app identity)
• OBF tokens → Authorize the bot to join on behalf of a specific user

You can combine them in the same bot request:

{
  "meeting_url": "https://zoom.us/j/123456789",
  "bot_name": "Recording Bot",
  "zoom_sdk_id": "YOUR_SDK_KEY",
  "zoom_sdk_pwd": "YOUR_SDK_SECRET",
  "zoom_obf_token_url": "https://your-api.com/zoom/obf-token"
}

This works with any of the three OBF options (zoom_obf_token, zoom_obf_token_url, or zoom_obf_token_user_id).

Learn more: Zoom AAN Documentation | Get Meeting SDK Credentials

Using SDK Credentials

If your bots only join meetings within your own Zoom organization, pass SDK credentials when creating bots:

curl -X POST "https://api.meetingbaas.com/bots" \
     -H "Content-Type: application/json" \
     -H "x-meeting-baas-api-key: YOUR-API-KEY" \
     -d '{
           "meeting_url": "https://zoom.us/j/123456789",
           "bot_name": "Recording Bot",
           "zoom_sdk_id": "YOUR_SDK_KEY",
           "zoom_sdk_pwd": "YOUR_SDK_SECRET"
         }'

import requests

response = requests.post(
    "https://api.meetingbaas.com/bots",
    headers={
        "Content-Type": "application/json",
        "x-meeting-baas-api-key": "YOUR-API-KEY",
    },
    json={
        "meeting_url": "https://zoom.us/j/123456789",
        "bot_name": "Recording Bot",
        "zoom_sdk_id": "YOUR_SDK_KEY",
        "zoom_sdk_pwd": "YOUR_SDK_SECRET"
    }
)
print(response.json())

const response = await fetch("https://api.meetingbaas.com/bots", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-meeting-baas-api-key": "YOUR-API-KEY",
  },
  body: JSON.stringify({
    meeting_url: "https://zoom.us/j/123456789",
    bot_name: "Recording Bot",
    zoom_sdk_id: "YOUR_SDK_KEY",
    zoom_sdk_pwd: "YOUR_SDK_SECRET",
  }),
});
console.log(await response.json());

Advanced: ZAK Token URL

If you need the bot to join as a specific Zoom user (not just as an anonymous participant), you can provide a ZAK (Zoom Access Key) token via the zoom_access_token_url parameter.

{
  "meeting_url": "https://zoom.us/j/123456789",
  "bot_name": "Recording Bot",
  "zoom_access_token_url": "https://your-api.com/zoom/zak-token"
}

When the bot calls your endpoint, it appends bot_uuid and extra as query parameters (same as with OBF token URLs). This lets you identify which ZAK token to return:

GET https://your-api.com/zoom/zak-token?bot_uuid=abc-123&extra={"user_id":"usr_456"}

Your endpoint should return the raw ZAK token as plain text (not JSON).

Submitting for Marketplace Approval

Your app does not need to be listed on the Zoom Marketplace for Meeting BaaS to work. However, approval is required if:

• You want a public listing for users to discover your app
• You want the "approved" badge for trust
• You are using OAuth and want external users to authorize your app

App Listing Section

Fill out the App Listing section:

Technical Design Section

Zoom requires details about your app's architecture. Here is what to include:

Technology Stack:

You can keep this high-level. Example:

Frontend: React, TailwindCSS
Backend: Python/Node.js
Auth: OAuth 2.0 (your provider)
Database: PostgreSQL
Hosting: AWS/GCP/Azure
Zoom Integration: Zoom Meeting SDK via Meeting BaaS API

Architecture Diagram:

Include a simple diagram showing:

• Your application
• Meeting BaaS API
• Zoom SDK integration

This does not need to be complex. A basic flow diagram works.

Application Development Section

If you have security certifications (SOC 2, ISO 27001), upload them. They are not required but help with approval.

Security Section

Privacy Section

Provide excerpts from your privacy policy covering:

• What data you collect
• How you use the data
• User data access rights
• How users can exercise those rights

Submitting for Review

Review Process

Usability Review:

• A Zoom reviewer logs into your app using the test credentials
• They test the meeting recording/transcription flow
• If issues are found, you will receive a "more information required" request

Security Review:

• Zoom tests for common vulnerabilities
• They may use tools like Burp Suite to check for issues
• Ensure server-side validation for all sensitive operations

Timeline: Expect 1-2 weeks for review. You can request expedited review for urgent cases.

Scopes Reference

Troubleshooting

SDK Authentication Failed

If you receive ZOOM_SDK_AUTH_FAILED:

1. Verify SDK Key and Secret are correct
2. Ensure Meeting SDK is enabled in your app
3. Check that your app is activated (not in draft status)
4. Confirm you are using the SDK credentials, not OAuth credentials

OAuth Token Exchange Failed

If the authorization code exchange fails:

1. Verify the redirect URI matches exactly (including trailing slashes)
2. Check that the authorization code has not expired (~10 minutes)
3. Ensure all required scopes are added to your app
4. Verify Client ID and Secret are correct

App Rejected During Review

Common rejection reasons:

• Missing or broken test credentials
• Privacy policy does not cover required topics
• Security vulnerabilities found (check for XSS, CSRF, etc.)
• Screenshots do not match actual app functionality

Next Steps

• OBF Token Support — If joining external meetings
• Building OAuth Consent Flow — Implementing user authorization
• Sending a Bot — Basic bot creation