Zoom Oauth

# Zoom OAuth Flows

Zoom supports 4 OAuth 2.0 flows. This guide helps you choose the right one and understand how each works.

Endpoint split to remember:
- Authorization URL: `https://zoom.us/oauth/authorize`
- Token URL: `https://zoom.us/oauth/token`

## Quick Decision Matrix

| Your Scenario | Flow | Grant Type |
|---------------|------|------------|
| Backend automation on **your own account** | S2S OAuth | `account_credentials` |
| SaaS app for **other Zoom users** | User OAuth | `authorization_code` |
| Device without browser (TV, kiosk, IoT) | Device Flow | `urn:ietf:params:oauth:grant-type:device_code` |
| **Team Chat bot only** | Chatbot | `client_credentials` |

## Two-Legged vs Three-Legged

| Type | User Involved? | Zoom Flows |
|------|----------------|------------|
| **Two-legged** | No (app acts on its own) | S2S OAuth, Chatbot |
| **Three-legged** | Yes (user authorizes app) | User OAuth, Device Flow |

---

## 1. Server-to-Server (S2S) OAuth

**When to use:**
- Backend automation on your own Zoom account
- No end-user interaction needed
- Account-wide API access

**Grant type:** `account_credentials`

**Token lifetime:**
- Access token: 1 hour
- Refresh token: None (request new token when expired)

**Credentials required:**
- Account ID
- Client ID
- Client Secret

### Flow Diagram

```
┌──────────────┐                                    ┌──────────────┐
│  Your App    │                                    │  Zoom OAuth  │
│  (Backend)   │                                    │    Server    │
└──────┬───────┘                                    └──────┬───────┘
       │                                                   │
       │  POST /oauth/token                                │
       │  grant_type=account_credentials                   │
       │  account_id={ACCOUNT_ID}                          │
       │  Authorization: Basic {CLIENT_ID:CLIENT_SECRET}   │
       │──────────────────────────────────────────────────>│
       │                                                   │
       │                                                   │ Validate
       │                                                   │ credentials
       │                                                   │
       │  { access_token, expires_in, scope }              │
       │<──────────────────────────────────────────────────│
       │                                                   │
       │  API Requests with Bearer token                   │
       │  (valid for 1 hour)                               │
       │                                                   │
```

### Implementation

```javascript
const axios = require('axios');
const qs = require('query-string');

const getToken = async () => {
  const response = await axios.post(
    'https://zoom.us/oauth/token',
    qs.stringify({
      grant_type: 'account_credentials',
      account_id: process.env.ZOOM_ACCOUNT_ID
    }),
    {
      headers: {
        'Authorization': `Basic ${Buffer.from(
          `${process.env.ZOOM_CLIENT_ID}:${process.env.ZOOM_CLIENT_SECRET}`
        ).toString('base64')}`,
        'Content-Type': 'application/x-www-form-urlencoded'
      }
    }
  );

  return response.data; // { access_token, expires_in, scope, token_type }
};
```

### Key Points

✅ **Simple:** No redirect URIs, no user interaction
✅ **Secure:** Credentials stored server-side only
✅ **Account-wide:** Single token for all account operations
⚠️ **No refresh token:** Just request a new token when expired (cache with TTL)

---

## 2. User Authorization OAuth

**When to use:**
- Building a SaaS app for other Zoom users
- Users authorize your app to act on their behalf
- Need per-user access control

**Grant type:** `authorization_code`

**Token lifetime:**
- Access token: 1 hour
- Refresh token: lifetime varies; ~90 days is common for some user-based flows (treat as changeable behavior)

**Credentials required:**
- Client ID
- Client Secret
- Redirect URI (must match marketplace app config)