Architecture

┌─────────────────────────────────────────────────────┐
│                    ZOOM CLIENT                       │
│                                                      │
│  ┌──────────────────────────────────────────────┐   │
│  │         Embedded Browser (WebView)            │   │
│  │                                               │   │
│  │  ┌─────────────────────────────────────────┐ │   │
│  │  │        YOUR FRONTEND WEB APP            │ │   │
│  │  │                                         │ │   │
│  │  │  import zoomSdk from '@zoom/appssdk'    │ │   │
│  │  │  zoomSdk.config({...})                  │ │   │
│  │  │  zoomSdk.getMeetingContext()             │ │   │
│  │  │                                         │ │   │
│  │  │     fetch('/api/data')  ──────────────────────── YOUR BACKEND
│  │  └─────────────────────────────────────────┘ │   │    (Express/Node.js)
│  │              │                                │   │    - OAuth token exchange
│  │              │ SDK Bridge                     │   │    - REST API calls
│  │              ▼                                │   │    - Business logic
│  │     Zoom Client APIs                         │   │    - Token storage
│  │     (meeting, user, UI)                      │   │
│  └──────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────┘

User clicks "Add" in Marketplace
         │
         ▼
Browser opens Zoom OAuth page
(https://zoom.us/oauth/authorize?client_id=...&code_challenge=...)
         │
         ▼
User clicks "Allow"
         │
         ▼
Zoom redirects to your redirect URI with ?code=...
         │
         ▼
Your backend exchanges code + code_verifier for access_token
         │
         ▼
Backend calls GET /v2/zoomapp/deeplink with access_token
         │
         ▼
Backend redirects user to deeplink URL
         │
         ▼
Zoom client opens, loads your frontend URL in embedded browser
         │
         ▼
Frontend calls zoomSdk.config({...})
         │
         ▼
App is ready

User opens your app in Zoom client
         │
         ▼
Zoom loads your frontend URL in embedded browser
         │
         ▼
Frontend calls zoomSdk.config({...})
         │
         ▼
Frontend calls zoomSdk.authorize({ codeChallenge, state })
         │
         ▼
User approves in Zoom popup (no browser redirect)
         │
         ▼
onAuthorized event fires with authorization code
         │
         ▼
Frontend sends code to backend
         │
         ▼
Backend exchanges code + code_verifier for tokens
         │
         ▼
App is authorized

// After token exchange, get deeplink
const response = await fetch('https://api.zoom.us/v2/zoomapp/deeplink', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ action: '' })
});

const { deeplink } = await response.json();
// deeplink = 'zoommtg://zoom.us/...' or similar

// Redirect user to open in Zoom client
res.redirect(deeplink);

const crypto = require('crypto');

function decryptContext(header, clientSecret) {
  const buf = Buffer.from(header, 'base64');
  const iv = buf.slice(0, 12);                    // First 12 bytes = IV
  const encryptedData = buf.slice(12, buf.length - 16); // Middle = ciphertext
  const tag = buf.slice(buf.length - 16);          // Last 16 bytes = auth tag

  const key = crypto.createHash('sha256')
    .update(clientSecret)
    .digest();

  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(tag);

  const decrypted = Buffer.concat([
    decipher.update(encryptedData),
    decipher.final()
  ]);

  return JSON.parse(decrypted.toString());
}

// Usage in Express middleware
app.use((req, res, next) => {
  const contextHeader = req.headers['x-zoom-app-context'];
  if (contextHeader) {
    req.zoomContext = decryptContext(contextHeader, process.env.ZOOM_APP_CLIENT_SECRET);
    // { uid: '...', aud: '...', iss: 'marketplace.zoom.us', ts: ..., ... }
  }
  next();
});