Subchapter 121.4

Bot Authentication

references/bot-authentication.mdMarkdown10 KBView on GitHub

Bot Authentication - JWT, ZAK, and OBF Tokens

Understanding the different token types for Meeting SDK authentication, especially for bots joining meetings.

Bot Authentication · Build Zoom Meeting SDK App · anthropics/knowledge-work-plugins · Skills Docs

Token	Purpose	Always Required?	Deprecated?
JWT Signature	Initialize/authenticate Meeting SDK	Yes	No
ZAK Token	Authenticate as a Zoom user	No (situational)	No
OBF Token	Join external meetings with user attribution	No (required Feb 2026)	No

Term	What It Is	Status
JWT App Type	A Zoom app type for REST API authentication	Deprecated (migrated to Server-to-Server OAuth)
JWT Signature	A token generated using SDK credentials to authenticate Meeting SDK	Still required and NOT deprecated

// Server-side (Node.js)
const KJUR = require('jsrsasign');

function generateSignature(sdkKey, sdkSecret, meetingNumber, role) {
  const iat = Math.round(Date.now() / 1000) - 30;  // 30 seconds ago
  const exp = iat + 60 * 60 * 2;                    // 2 hours from iat
  
  const payload = {
    sdkKey: sdkKey,        // Your SDK Client ID
    mn: meetingNumber,     // Meeting number to join
    role: role,            // 0 = participant, 1 = host
    iat: iat,
    exp: exp,
    tokenExp: exp
  };
  
  const header = { alg: 'HS256', typ: 'JWT' };
  
  return KJUR.jws.JWS.sign('HS256', 
    JSON.stringify(header), 
    JSON.stringify(payload), 
    sdkSecret              // Your SDK Client Secret
  );
}

// Generate token just before joining
const iat = Math.floor(Date.now() / 1000) - 7200;  // 2 hours in past
const exp = Math.floor(Date.now() / 1000) + 10;    // 10 seconds from now

// Why this works:
// - exp is short-lived (security)
// - exp - iat >= 2 hours (Zoom requirement)
// - Token generated right before use

Role	Value	Description
Participant	0	Join as attendee
Host	1	Join as host (requires being meeting owner or having host key)

Scenario	ZAK Required?
Meeting has “Only Authenticated Users Can Join” enabled	Yes
Starting a meeting as the host (when host not present)	Yes (host’s ZAK)
Changing bot’s profile picture to match a user	Yes
Regular meeting join	No

// Web SDK
ZoomMtg.join({
  signature: signature,      // JWT signature (always required)
  sdkKey: clientId,
  meetingNumber: meetingNumber,
  passWord: password,
  userName: "Meeting Bot",
  zak: zakToken,             // ZAK token for authenticated join
  success: (success) => console.log('Joined'),
  error: (error) => console.error(error)
});

Date	External Meeting Requirement
Before Feb 23, 2026	ZAK or OBF (optional)
After Feb 23, 2026	ZAK or OBF required

Aspect	ZAK Token	OBF Token
User presence required	No	Yes - user MUST be in meeting
Bot disconnection	Stays if token owner leaves	Immediately disconnected if user leaves
Meeting scope	Any meeting	Specific meeting ID only
Attribution	Generic authentication	Tied to specific attending user

// Web SDK
ZoomMtg.join({
  signature: signature,      // JWT signature (always required)
  sdkKey: clientId,
  meetingNumber: meetingNumber,
  passWord: password,
  userName: "Meeting Bot",
  obfToken: obfToken,        // OBF token (NOT zak)
  success: (success) => console.log('Joined'),
  error: (error) => console.error(error)
});

// SDK v6.6.10+ returns specific error code
// MEETING_FAIL_AUTHORIZED_USER_NOT_INMEETING

async function joinWithRetry(joinOptions, maxRetries = 5) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      await ZoomMtg.join(joinOptions);
      return; // Success
    } catch (error) {
      if (error.code === 'MEETING_FAIL_AUTHORIZED_USER_NOT_INMEETING') {
        console.log(`User not in meeting yet. Retry ${i + 1}/${maxRetries}`);
        await sleep(3000); // Wait 3 seconds
      } else {
        throw error; // Different error, don't retry
      }
    }
  }
  throw new Error('Max retries exceeded - user never joined meeting');
}

// 1. Generate JWT signature (always required)
const signature = await generateSignature(sdkKey, sdkSecret, meetingNumber, 0);

// 2. Optionally get ZAK for authenticated-only meetings
let zakToken = null;
if (meetingRequiresAuth) {
  zakToken = await getZAKToken(accessToken);
}

// 3. Join meeting
await ZoomMtg.join({
  signature: signature,
  sdkKey: sdkKey,
  meetingNumber: meetingNumber,
  passWord: password,
  userName: "Meeting Bot",
  zak: zakToken,  // Optional
});

// 1. Generate JWT signature (always required)
const signature = await generateSignature(sdkKey, sdkSecret, meetingNumber, 0);

// 2. For external meetings, get OBF token
const obfToken = await getOBFToken(accessToken, meetingNumber);

// 3. Wait for authorizing user to join (if using OBF)
// ... implement retry logic ...

// 4. Join meeting
await ZoomMtg.join({
  signature: signature,
  sdkKey: sdkKey,
  meetingNumber: meetingNumber,
  passWord: password,
  userName: "Meeting Bot",
  obfToken: obfToken,  // For external meetings
});

# Clone sample repository
git clone git@github.com:zoom/meetingsdk-headless-linux-sample.git

# Configure (sample.config.toml)
[credentials]
client_id = "YOUR_CLIENT_ID"
client_secret = "YOUR_CLIENT_SECRET"

[meeting]
join_url = "https://zoom.us/j/123456789?pwd=xxx"
# OR
meeting_id = 123456789
password = "abc123"

# Optional tokens
zak_token = "..."   # For authenticated joins
obf_token = "..."   # For external meetings

# Run with Docker
docker compose up

Mistake	Reality	Fix
JWT signatures are deprecated	Only JWT App Type is deprecated	Continue using JWT signatures for SDK
ZAK must be from meeting participant	Any Zoom account’s ZAK works	Use single service account
Using both ZAK and OBF together	They’re mutually exclusive	Use only one
Generating OBF before user in meeting	OBF requires user presence	Implement retry logic
Development credentials for external meetings	Dev credentials only work for your account	Get production credentials (4-6 week review)

Date	Change
Now	JWT signatures required; ZAK optional
Nov 2025	SDK v6.6.10 with OBF-specific error codes
Feb 23, 2026	OBF or ZAK required for external meetings

Bot Authentication

Bot Authentication - JWT, ZAK, and OBF Tokens

Bot Authentication

Bot Authentication - JWT, ZAK, and OBF Tokens

Token Types Summary

Common Confusion

JWT App Type vs JWT Signature

1. JWT Signature (Always Required)

What Is It?

When to Use

How to Generate

Best Practice: Short-Lived Tokens

Role Values

2. ZAK Token (Zoom Access Key)

What Is It?

When to Use

How to Get ZAK Token

Required OAuth Scope

Using ZAK in SDK Join

Key Properties

Common Mistake

3. OBF Token (On-Behalf-Of Token)

What Is It?

Why Introduced?

When to Use

Critical Difference: OBF vs ZAK

How to Get OBF Token

Required OAuth Scope

Using OBF in SDK Join

Handling Join Failures

OBF Token Mapping

Complete Bot Join Flow

Current (Pre-Feb 2026)

Post-Feb 2026 (External Meetings)

Linux Bot Implementation

Common Mistakes

Timeline

OAuth Scopes Summary

Resources