Setting the file. One moment.
Skill 147 · Build Zoom Video SDK App
Subchapter 147.1
references/authorization.mdMarkdown4 KBView on GitHub
Video SDK uses JWT (JSON Web Token) signatures to authenticate users joining video sessions. Signatures must be generated server-side to protect your SDK Secret.
Important: Unlike Zoom Meetings, Video SDK sessions are NOT pre-created. The tpc (topic) in your JWT can be any string you choose - the session is created when the first participant joins with that topic.
| Claim | Description |
|---|---|
app_key | Your SDK Key |
tpc | Topic (session name) - any string you choose |
role_type | 0 = participant, 1 = host |
user_identity | (Optional) Unique user identifier |
iat | Issued at timestamp |
exp | Expiration timestamp |
Note on tpc (Topic):
"room-123", "consultation-abc", "game-lobby-5")tpc value join the same sessionIn Video SDK, host/co-host status is determined entirely by role_type in the JWT — not by runtime API calls.
| role_type | First to Join | Subsequent Joiners |
|---|---|---|
| 1 | Host | Co-host |
| 0 | Participant | Participant |
client.leave(true) to end session for allleave(true) only leaves themselvesmakeHost() or makeManager() API calls — use JWT roleType insteadFor scenarios where you need a bot to create and manage the session:
role_type: 1 → becomes host (creates session)role_type: 1 → becomes co-hostrole_type: 0 → participantThis pattern avoids race conditions from runtime host assignment.
// JWT generation examples
generateJWT(key, secret, sessionName, 1, 'SessionBot'); // Bot: host
generateJWT(key, secret, sessionName, 1, 'Advisor'); // Advisor: co-host
generateJWT(key, secret, sessionName, 0, 'Customer'); // Customer: participantFor security, generate tokens with short expiry:
const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours in the past
const exp = Math.floor(Date.now() / 1000) + 10; // 10 seconds from now
const payload = {
app_key: SDK_KEY,
tpc: topic,
role_type: role,
user_identity: userIdentity,
iat: iat,
exp: exp
};Why this works:
exp is only 10 seconds after generation (short-lived for security)iat is set 2 hours in the past to satisfy Zoom’s requirement that exp - iat >= 2 hoursconst jwt = require('jsonwebtoken');
function generateSignature(sdkKey, sdkSecret, topic, role, userIdentity) {
const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours ago
const exp = Math.floor(Date.now() / 1000) + 10; // 10 seconds from now
const payload = {
app_key: sdkKey,
tpc: topic,
role_type: role,
user_identity: userIdentity || '',
iat: iat,
exp: exp
};
return jwt.sign(payload, sdkSecret, { algorithm: 'HS256' });
}| Do | Don’t |
|---|---|
| Generate signatures server-side | Expose SDK Secret in client code |
| Use short expiry times | Use long-lived tokens |
| Validate user before generating | Generate for unauthenticated users |