OAuth Setup

• App type: General App (OAuth)
• Redirect URL: your app’s callback URL
• Scopes (typical):
  • chat_message:write
  • chat_channel:read

Flow Summary

1. Redirect user to Zoom authorize URL.
2. Receive code at your redirect URL.
3. Exchange code for access_token + refresh_token.
4. Store tokens per-user.
5. Refresh the access token when it expires.

In-App Web Flow Pattern (Recommended)

For browser demos, keep the whole flow in your app to avoid manual copy/paste mistakes:

1. User clicks Connect Zoom User in your UI.
2. Backend returns authorize URL (https://zoom.us/oauth/authorize) with a generated state.
3. Redirect browser to Zoom consent screen.
4. Callback route validates state and exchanges code at https://zoom.us/oauth/token.
5. Callback page stores token in app storage (for demo: localStorage, for production: server session/DB) and redirects back to app.

Token Exchange (Server Side)

Pseudo-code (Node style):

Common Errors

• Invalid redirect: redirect URL mismatch between code exchange and Marketplace config.
• Invalid access token, does not contain scopes: missing scopes on the app or user didn’t re-consent after scope change.

Next

• send-message.md to post a message once you have a user token.
• token-management.md for refresh strategy.