JWT With Zoom


Below are examples of how to obtain your API Key/Secret and the minimum properties needed to generate your API Key/Secret for using Zoom APIs.

Generating your API Key & Secret

You can generate your API credentials for your app by logging into Marketplace and creating a JWT app. After you provide basic information about your app, you can locate your API Key and API Secret in the next page named App Credentials.

Obtaining your API Key & Secret

If you have previously created a JWT app, you can obtain your API Key/Secret by logging into Marketplace and clicking Manage.

Under Created Apps, locate and click on your app’s name. You can find your API Key and your API Secret under App Credentials.

You can also regenerate your API secret if needed.

Requirements to Generate JWT

Below are the required header, payload, and signature properties needed to generate a JWT for using Zooms API.

Header

alg refers to the algorithm being used, Zooms API uses HMAC SHA256 (HS256 for short).

typ refers to the type of token, it should always be set to JWT.

Header
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

iss is the issuer of the token, this is your Zoom API Key.

exp is the expiration timestamp of the token in seconds since the Epoch. Each day should be accounted for by exactly 86400 seconds.

Payload
{
  "iss": "API_KEY",
  "exp": 1496091964000
}

It is recommended to use one of the JWT supported libraries to generate your tokens and to set the exp timestamp for a short period (ie. seconds). That way if someone intercepts your token, your token won’t be valid for a couple seconds.

Signature

Below, you’ll find an example algorithm for generating a JWT signature. Within the signature algorithm, encode your header & payload then include your API_Secret.

Signature
HMACSHA256(
    base64UrlEncode(header) + "." +
    base64UrlEncode(payload),
    API_SECRET)

Generating JWT for Testing

Within the App credentails page, you will see an option to View JWT Token.

Here you can quickly generate a temporary token using the current API Key & Secret. You can then use the token generated to test Zoom APIs to retrive/send information to your account.

Generate your Token with JWT.io

You can also generate your JWT by using jwt.io. On the right hand side, input your API Key in the iss field of the payload and the expiration time in exp field. The exp field represents the expiration timestamp of the token in seconds since the Epoch. Each day should be accounted for by exactly 86400 seconds. Next, provide your API secret in the your-256-bit-secret field under the Verify Signature section. On the left hand side, you should see your JWT generated.

Make API calls using your JWT

The following code snippet can get you started with making API calls using your JWT. If you’d like to see a complete working app tutorial that generates a JWT using server-side code and makes Zoom API calls, read our Quickstart - JWT guide.

//Make Zoom API call
var options = {
    uri: 'https://api.zoom.us/v2/users',
    qs: {
        status: 'active' // -> uri + '?status=active'
    },
    auth: {
      //Provide your token here
    		'bearer': token
  	},
    headers: {
        'User-Agent': 'Zoom-Jwt-Request',
        'content-type': 'application/json'
    },
    json: true // Automatically parses the JSON string in the response
};

rp(options)
    .then(function (response) {
      //logic for your response
        console.log('User has', response);
    })
    .catch(function (err) {
        // API call failed...
        console.log('API call failed, reason ', err);
    });

You can find more details and specifics about JWT at jwt.io.


Need Support?

The first place to look for help is on our Developer Forum, where Zoom Marketplace Developers can ask questions for public answers.

If you can’t find the answer in the Developer Forum or your request requires sensitive information to be relayed, please email us at developersupport@zoom.us.