Zoom

Overview

Connect your users to Zoom for meetings, webinars, and cloud recordings.

Property	Value
Provider ID	zoom
Category	Communication
PKCE	Not supported (confidential clients)
Token refresh	Automatic (rotating refresh tokens)
Redirect URI	Shown in Developer Portal

Step 1: Create a Zoom OAuth App

Go to the Zoom App Marketplace

Navigate to the Zoom App Marketplace and sign in.

Create a General App

Click Develop > Build App and create a General App. Set the app type to User-managed app so each user authorizes their own account.

Configure the redirect URL

Add the Alter callback URL (from the Developer Portal) to the OAuth Redirect URL field on the app’s Basic Information page.

Add scopes

Open the Scopes tab and add every API scope the integration needs. Zoom grants scopes from the app configuration — not from the authorization URL.

Get credentials

Copy the Client ID and Client Secret from the app’s Basic Information page.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Zoom provider

Go to OAuth Providers > Add Provider > Zoom.

Enter credentials

• Client ID: Paste your Zoom Client ID
• Client Secret: Paste your Zoom Client Secret

Save

Click Save. The provider is now active.

Scopes

Zoom does not accept a scope parameter in the authorization URL. Scopes are configured on the Marketplace app’s Scopes tab and granted as a bundle when the user consents. After changing scopes, users must re-authorize the app.

Account-level (:admin) scopes require authorization by a user with the matching admin role permissions.

Notes

• Zoom uses rotating refresh tokens — each refresh returns a new refresh token. Alter Vault stores the latest token automatically.
• Access tokens expire after 1 hour; refresh tokens expire after roughly 90 days of inactivity, after which the user must re-authorize.
• See the Zoom OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
meetings	read	GET	/users/{userId}/meetings
meeting	read	GET	/meetings/{meetingId}
meetingCreate	write	POST	/users/{userId}/meetings
meetingUpdate	write	PATCH	/meetings/{meetingId}
meetingDelete	delete	DELETE	/meetings/{meetingId}
meetingInvitation	read	GET	/meetings/{meetingId}/invitation
users	read	GET	/users
user	read	GET	/users/{userId}
userCreate	admin	POST	/users
userDelete	admin, delete	DELETE	/users/{userId}
reportMeetings	read	GET	/report/users/{userId}/meetings
sendaChatMessage	send	POST	/chat/users/{userId}/messages
getChatMessages	read	GET	/chat/users/{userId}/messages
editMessage	write	PUT	/chat/users/{userId}/messages/{messageId}
deleteChatMessage	delete	DELETE	/chat/users/{userId}/messages/{messageId}
createChannel	write	POST	/chat/users/{userId}/channels
getChannels	read	GET	/chat/users/{userId}/channels
deleteChannel	delete	DELETE	/chat/users/{userId}/channels/{channelId}
inviteChannelMembers	admin	POST	/chat/users/{userId}/channels/{channelId}/members
joinChannel	write	POST	/chat/channels/{channelId}/members/me
leaveChannel	write	DELETE	/chat/channels/{channelId}/members/me
recordingsList	read	GET	/users/{userId}/recordings
recordingDelete	delete	DELETE	/meetings/{meetingId}/recordings
webinars	read	GET	/users/{userId}/webinars
webinarCreate	write	POST	/users/{userId}/webinars
webinarDelete	delete	DELETE	/webinars/{webinarId}