Setting the file. One moment.
Skill 121 · Build Zoom Meeting SDK App
Subchapter 121.3
references/authorization.mdMarkdown2 KBView on GitHub
Meeting SDK uses JWT (JSON Web Token) signatures to authenticate users joining meetings. Signatures must be generated server-side to protect your SDK Secret.
| Claim | Description |
|---|---|
sdkKey | Your SDK Key |
mn | Meeting number |
role | 0 = participant, 1 = host |
iat | Issued at timestamp |
exp | Expiration timestamp |
tokenExp | Token expiration timestamp |
For security, generate tokens with short expiry:
const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours in the past
const exp = Math.floor(Date.now() / 1000) + 10; // 10 seconds from now
const payload = {
sdkKey: SDK_KEY,
mn: meetingNumber,
role: role,
iat: iat,
exp: exp,
tokenExp: exp
};Why this works:
exp is only 10 seconds after generation (short-lived for security)iat is set 2 hours in the past to satisfy Zoom’s requirement that exp - iat >= 2 hoursconst jwt = require('jsonwebtoken');
function generateSignature(sdkKey, sdkSecret, meetingNumber, role) {
const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours ago
const exp = Math.floor(Date.now() / 1000) + 10; // 10 seconds from now
const payload = {
sdkKey: sdkKey,
mn: meetingNumber,
role: role,
iat: iat,
exp: exp,
tokenExp: exp
};
return jwt.sign(payload, sdkSecret, { algorithm: 'HS256' });
}| Role | Value | Description |
|---|---|---|
| Participant | 0 | Join as attendee |
| Host | 1 | Join as host (requires host key or being meeting owner) |
| Do | Don’t |
|---|---|
| Generate signatures server-side | Expose SDK Secret in client code |
| Use short expiry times | Use long-lived tokens |
| Validate user before generating | Generate for unauthenticated users |