function ConnectZoomButton() {
  const handleConnect = () => {
    const params = new URLSearchParams({
      response_type: "code",
      client_id: process.env.REACT_APP_ZOOM_CLIENT_ID,
      redirect_uri: `${window.location.origin}/oauth/zoom/callback`,
      state: crypto.randomUUID(), // Store this to verify later
    });

    window.location.href = `https://zoom.us/oauth/authorize?${params}`;
  };

  return (
    <button onClick={handleConnect}>
      Connect Zoom Account
    </button>
  );
}

import { redirect } from "next/navigation";
import { cookies } from "next/headers";

export default function ConnectZoomPage() {
  async function connectZoom() {
    "use server";

    const state = crypto.randomUUID();

    // Store state in cookie for verification
    cookies().set("zoom_oauth_state", state, {
      httpOnly: true,
      secure: true,
      sameSite: "lax",
      maxAge: 600, // 10 minutes
    });

    const params = new URLSearchParams({
      response_type: "code",
      client_id: process.env.ZOOM_CLIENT_ID!,
      redirect_uri: `${process.env.NEXT_PUBLIC_APP_URL}/oauth/zoom/callback`,
      state,
    });

    redirect(`https://zoom.us/oauth/authorize?${params}`);
  }

  return (
    <form action={connectZoom}>
      <button type="submit">Connect Zoom Account</button>
    </form>
  );
}

const express = require("express");
const crypto = require("crypto");
const router = express.Router();

router.get("/connect", (req, res) => {
  const state = crypto.randomUUID();

  // Store state in session for verification
  req.session.zoomOAuthState = state;

  const params = new URLSearchParams({
    response_type: "code",
    client_id: process.env.ZOOM_CLIENT_ID,
    redirect_uri: `${process.env.APP_URL}/oauth/zoom/callback`,
    state,
  });

  res.redirect(`https://zoom.us/oauth/authorize?${params}`);
});

module.exports = router;

import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { NextRequest } from "next/server";

export async function GET(request: NextRequest) {
  const searchParams = request.nextUrl.searchParams;
  const code = searchParams.get("code");
  const state = searchParams.get("state");
  const error = searchParams.get("error");

  // Handle user denial
  if (error) {
    redirect("/settings?error=zoom_denied");
  }

  // Verify state to prevent CSRF
  const storedState = cookies().get("zoom_oauth_state")?.value;
  if (state !== storedState) {
    redirect("/settings?error=invalid_state");
  }

  // Clear the state cookie
  cookies().delete("zoom_oauth_state");

  // Exchange code for credential via Meeting BaaS
  const response = await fetch("https://api.meetingbaas.com/v2/zoom-credentials", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-meeting-baas-api-key": process.env.MEETING_BAAS_API_KEY!,
    },
    body: JSON.stringify({
      name: `User ${userId}`, // Get from your session
      client_id: process.env.ZOOM_CLIENT_ID,
      client_secret: process.env.ZOOM_CLIENT_SECRET,
      authorization_code: code,
      redirect_uri: `${process.env.NEXT_PUBLIC_APP_URL}/oauth/zoom/callback`,
    }),
  });

  if (!response.ok) {
    console.error("Failed to create credential:", await response.text());
    redirect("/settings?error=zoom_exchange_failed");
  }

  const { data } = await response.json();

  // Store the credential_id, zoom_user_id, and zoom_email in your database
  await saveZoomCredential(userId, {
    credentialId: data.credential_id,
    zoomUserId: data.zoom_user_id,
    zoomEmail: data.zoom_email, // shows the user which Zoom account is connected
  });

  redirect("/settings?success=zoom_connected");
}

router.get("/callback", async (req, res) => {
  const { code, state, error } = req.query;

  // Handle user denial
  if (error) {
    return res.redirect("/settings?error=zoom_denied");
  }

  // Verify state
  if (state !== req.session.zoomOAuthState) {
    return res.redirect("/settings?error=invalid_state");
  }

  delete req.session.zoomOAuthState;

  try {
    // Exchange code for credential via Meeting BaaS
    const response = await fetch("https://api.meetingbaas.com/v2/zoom-credentials", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-meeting-baas-api-key": process.env.MEETING_BAAS_API_KEY,
      },
      body: JSON.stringify({
        name: `User ${req.user.id}`,
        client_id: process.env.ZOOM_CLIENT_ID,
        client_secret: process.env.ZOOM_CLIENT_SECRET,
        authorization_code: code,
        redirect_uri: `${process.env.APP_URL}/oauth/zoom/callback`,
      }),
    });

    if (!response.ok) {
      throw new Error(await response.text());
    }

    const { data } = await response.json();

    // Save to your database
    await db.user.update({
      where: { id: req.user.id },
      data: {
        zoomCredentialId: data.credential_id,
        zoomUserId: data.zoom_user_id,
        zoomEmail: data.zoom_email,
      },
    });

    res.redirect("/settings?success=zoom_connected");
  } catch (err) {
    console.error("Zoom OAuth error:", err);
    res.redirect("/settings?error=zoom_exchange_failed");
  }
});

from flask import Flask, request, redirect, session
import requests

@app.route("/oauth/zoom/callback")
def zoom_callback():
    code = request.args.get("code")
    state = request.args.get("state")
    error = request.args.get("error")

    # Handle user denial
    if error:
        return redirect("/settings?error=zoom_denied")

    # Verify state
    if state != session.get("zoom_oauth_state"):
        return redirect("/settings?error=invalid_state")

    del session["zoom_oauth_state"]

    # Exchange code for credential via Meeting BaaS
    response = requests.post(
        "https://api.meetingbaas.com/v2/zoom-credentials",
        headers={
            "Content-Type": "application/json",
            "x-meeting-baas-api-key": os.environ["MEETING_BAAS_API_KEY"],
        },
        json={
            "name": f"User {current_user.id}",
            "client_id": os.environ["ZOOM_CLIENT_ID"],
            "client_secret": os.environ["ZOOM_CLIENT_SECRET"],
            "authorization_code": code,
            "redirect_uri": f"{os.environ['APP_URL']}/oauth/zoom/callback",
        },
    )

    if not response.ok:
        print(f"Zoom OAuth error: {response.text}")
        return redirect("/settings?error=zoom_exchange_failed")

    data = response.json()["data"]

    # Save to your database
    current_user.zoom_credential_id = data["credential_id"]
    current_user.zoom_user_id = data["zoom_user_id"]
    current_user.zoom_email = data["zoom_email"]
    db.session.commit()

    return redirect("/settings?success=zoom_connected")