Zoom
Zoom uses standard OAuth 2.0 through a 'General app' you create by hand in the Zoom App Marketplace, and you can connect your own account in about 30 minutes. Before other clinics' Zoom accounts can connect, the app must be published (publicly or unlisted) and pass Zoom's App Review, which has a functional stage and then a security stage. Zoom gives no fixed timeline, and forum reports say the security stage alone can take a month or more, so plan for several weeks.
Review: Zoom Marketplace App Review (functional, then security) before users outside your account can install.
Timing: Depends mostly on how long the security review takes (forum reports range from days to over a month) and on how many resubmission rounds about the domain, scopes, documentation or test plan you need; recording, transcript or health-data scopes may add scrutiny.
Cost: No review fee was found in the research. This is unconfirmed. API rate limits depend on each clinic's Zoom plan.
Before you start
- for buildZoom account with access to marketplace.zoom.us (developer)sourceds3
- for buildRedirect URL https://app.iskaria.com/api/oauth/zoom/callback, also added to the OAuth Allow List✓ Iskaria has itsourceds3
- for buildLocalhost redirect http://localhost:3000/api/oauth/zoom/callback for development (may not be accepted)✓ Iskaria has itinferred
- for launchVerified domain for app submission (iskaria.com)✓ Iskaria has itsourceds6
- for launchPrivacy policy URL✓ Iskaria has itinferred
- for launchTerms of use URL✓ Iskaria has itinferred
- for launchSupport URL and contact email✓ Iskaria has itinferred
- for buildDeveloper contact email✓ Iskaria has itinferred
- for launchApp name and description✓ Iskaria has itinferred
- for launchApp logo exported as a PNG (MISSING: no 512px PNG has been exported yet)✓ Iskaria has itinferred
- for launchTest credentials (a Zoom test account plus an Iskaria test login) for reviewerssourceds6
- for launchLegal entity name for the Marketplace developer or company profile (MISSING)✗ missing in profileinferred
- for launchDemo video (MISSING; may be requested)✗ missing in profileinferred
- for launchShared support mailbox instead of a personal address (MISSING)✗ missing in profileinferred
Who does what
- Implement the OAuth code flow with PKCE, token refresh and revocation
- Draft scope justifications, the Technical Design section, documentation and the test plan
- Draft listing texts and a demo script
- Log in to the Marketplace and create the app
- Accept Zoom's terms
- Verify the domain in Zoom
- Provide reviewer test credentials
- Click Submit for review and respond to reviewers
- Export the logo and set up a shared support mailbox
Steps
Log in at marketplace.zoom.us with the Iskaria Zoom account and accept the developer terms if prompted.
https://marketplace.zoom.us/Go to Develop → Build App → General app → Create. On Basic Info, choose Admin-managed so a clinic's account admin installs the app for the whole account.
https://marketplace.zoom.us/App name Iskaria How is the app managed? Admin-managed recommended for clinic accounts - 3Set the redirect URL and Allow List, then store the credentialsAgent drafts, you submit10 minsourceds3s18
Set the OAuth redirect URL to https://app.iskaria.com/api/oauth/zoom/callback and add it to the OAuth Allow List (try the localhost URL for development). Copy the development client ID and secret into the server-side secret store. The token endpoint uses client_secret_basic, so the secret must never reach the browser.
OAuth redirect URL ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"] OAuth Allow List ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"] Add granular scopes (user:read:user, meeting:read:list_meetings, meeting:read:meeting, meeting:write:meeting). Leave out recording and transcript scopes unless they are truly needed. Draft a short justification for each scope.
Authorize at https://zoom.us/oauth/authorize and exchange the code at https://zoom.us/oauth/token using S256 PKCE and HTTP Basic client authentication. Store refresh tokens encrypted per tenant and replace them on every refresh. Use https://zoom.us/oauth/revoke when a clinic disconnects.
Connect your own Zoom account using the development credentials. To let a pilot clinic connect before launch, use Request to Share and renew the shared URL when it expires.
- 7Prepare the listing, Technical Design section and test planAgent drafts, you submit3 hsourceds5s6s17
Fill in all required fields and complete the mandatory Technical Design section. Prepare documentation, a test plan and reviewer test credentials. Verify iskaria.com in Zoom, and export the logo.
Privacy policy URL https://iskaria.com/privacy Terms of use URL https://iskaria.com/terms Support URL https://iskaria.com/support Support email ibrahim@iskaria.com Short/long description Iskaria is a multi-clinic operations console with an AI assistant. Clinic staff connect their business accounts so the assistant can answer patient messages, track leads and report on marketing performance. Logo {"square512Png":null,"note":"Systems Mark logo exists as a design canvas; no exported 512px PNG yet"}needs export Domain verification app.iskaria.com Submit the app. Zoom runs a functional review first, then a security review. Answer reviewer questions promptly and resubmit if asked.
Once the app is published, deploy the production client ID and secret, which are separate from the development pair.
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| user:read:user | Identify the connected Zoom user | basic | inferred |
| meeting:read:list_meetings | List the clinic's meetings for the assistant | basic | inferred |
| meeting:read:meeting | Read details of a single meeting | basic | inferred |
| meeting:write:meeting | Create telehealth or consultation links when booking Per-user daily cap of 400 meeting create/update calls | basic | inferreds13 |
| cloud_recording:read:list_recording_files | Optional: access recordings and transcripts Likely extra security-review scrutiny, especially with patient data | sensitive | inferred |
What can slow you down or block approval
After passing functional review, developers report waiting a month or more for the security review. Zoom staff will not commit to a timeline.
Workaround: Submit early, request minimal scopes, and have the Technical Design section and test plan complete before submitting.
Clinic and patient context, combined with recording or transcript scopes, may trigger HIPAA or BAA questions. Iskaria has no SOC 2 or ISO 27001.
Workaround: Leave out recording and transcript scopes for v1, and document the per-tenant encryption.
There is no exported logo PNG, no demo video, no legal entity name and no shared support mailbox.
Workaround: Export the 512px logo, set up support@iskaria.com, and record a demo.
The probe found no registration_endpoint, so an agent cannot register a client itself. The app must be created by hand in the Marketplace.
Adding scopes to a published app requires resubmission, and existing users must reauthorize.
Workaround: Decide on the full scope set before the first submission.
Server-to-Server OAuth works only within your own account, and JWT apps are deprecated. Use a General app with the authorization code flow.
What we checked
| Claim | How | Result |
|---|---|---|
| Review is needed before users outside your account can install | Search snippets of the official blog and distribute docs | confirmed |
| Development apps are limited to your own account unless approved through Request to Share No numeric user cap was found. | Search snippets of the sharing-private-and-beta-apps page and blog | confirmed |
| Review wait time Anecdotal only; Zoom staff say it depends. | Three forum threads | unverified |
| Granular scopes are mandatory for new apps Zoom's own page was not fetched. | Third-party recall.ai docs | confirmed |
| Endpoints, PKCE support and no dynamic client registration | Probed .well-known metadata on 2026-10-30 | confirmed |
- Full official pages were not fetched; 'sourced' claims rest on search snippets.
- Exact required submission fields (demo video, screenshots).
- How long Request to Share authorization URLs stay valid, and whether there is a user cap.
- Whether localhost redirect URLs are allowed in development.
- Token lifetimes (about 1 hour for access tokens and about 90 days for rotating refresh tokens is unverified).
- Which specific scopes trigger extra security review.
- Review fee, business verification and legal-entity requirements are not confirmed.
- Whether HIPAA or BAA questions arise for clinic use.
- Review times are anecdotal only; forum reports range from about 1 day to over a month.
- Discovery metadata advertises client_credentials, jwt-bearer and device_code grants; their applicability to General apps is unverified.
Sources
- s1OAuth 2.0 – Zoom Developer Docs · official-docs · accessed 2026-10-30
“Zoom supports industry-standard OAuth 2.0 (rfc6749 ) flows to handle authorization and access tokens.”
- s2Create an OAuth app · official-docs · accessed 2026-10-30
“App credentials for development differ from app credentials for production”
- s3Select general app features · official-docs · accessed 2026-10-30
“OAuth redirect URL (required): Enter your development redirect URL”
- s4App distribution · official-docs · accessed 2026-10-30
“These apps are intended for internal use and don't require the standard Marketplace review.”
- s5App Review Process · official-docs · accessed 2026-10-30
“all developers must complete the Technical Design section of the build flow.”
- s6Submit apps for review · official-docs · accessed 2026-10-30
“provide test credentials that allow Zoom reviewers to fully experience your integration.”
- s7Sharing Private and Beta Apps · official-docs · accessed 2026-10-30
“To share the authorization URL with users outside of your developer account, select Request to Share.”
- s8Updating an App · official-docs · accessed 2026-10-30
“manage scope changes, handle user reauthorization”
- s9How to limit who can install my Marketplace App · official-docs · accessed 2026-10-30
“you will need to publish it to the Zoom App Marketplace.”
- s10Zoom App Marketplace Review Process · community · accessed 2026-10-30
- s11Security Review · community · accessed 2026-10-30
“passed functional testing and was now awaiting a security review”
- s12Zoom App Security Review · community · accessed 2026-10-30
- s13About the Latest Rate Limits · community · accessed 2026-10-30
“You have exceeded the daily rate limit (400) of Meeting Create/Update API requests permitted for this particular user.”
- s14Zoom OAuth Setup (granular scopes) · community · accessed 2026-10-30
“any newly created apps will use these new granular scopes.”
- s15
- s16Zoom Migration Guide · community · accessed 2026-10-30
“As of September 8, 2023, Zoom has deprecated JWT authentication”
- s17What I Prepared Before Publishing a Zoom Marketplace App · community · accessed 2026-10-30
“Most of the review rounds covered the things around the code: the domain, the scopes, the documentation, and the test plan.”
- s18Probe of Zoom OAuth discovery metadata · our-test · accessed 2026-10-30
“authorization_endpoint https://zoom.us/oauth/authorize; token_endpoint https://zoom.us/oauth/token; PKCE S256; client_secret_basic; no registration_endpoint”