OAuth Setup

The documented path for Zoom MCP is a General app using user-level OAuth. Each user authorizes with their own Zoom account, and the resulting bearer token is passed by the bundled connector in .mcp.json (opens in a new tab).

Step 1: Create a General App with User-Level OAuth

1. Go to marketplace.zoom.us (opens in a new tab) → Develop → Build App.
2. Create a General app.
3. Configure the app for user-level OAuth for the per-user MCP path.
4. Set a redirect URL for your client or local test environment.
5. Note the client ID and client secret.

If You Do Not Already Have a Redirect Endpoint

For development, two pragmatic options are:

Option 0: localhost and manually copy the code

Example:

If the local app does not actually handle the callback yet, the browser may show a failed page load. You can still copy the code and state values from the browser URL and paste them into Claude or your terminal flow so the token exchange can continue manually.

Pros:

• no tunnel and no third-party capture service
• fastest setup if you only need the authorization code once
• keeps the authorization code on your machine

Cons:

• manual copy/paste step every time
• no automatic code exchange or refresh flow
• less convenient if you repeat the auth flow often

Option 1: ngrok in front of a local callback server

Example:

Pros:

• best match for the real OAuth flow because your own app receives the callback directly
• easy to inspect requests locally while keeping your app logic in one place
• useful if you also need to exchange the code for tokens automatically

Cons:

• requires running a local server plus the tunnel
• slightly more setup than a capture-only endpoint
• you are exposing a local service to the internet, so keep the callback narrow and temporary

Option 2: webhook.site for one-off callback capture

Example:

Pros:

• fastest path when you just need to capture the authorization redirect once
• no local server required
• easy to inspect the query string and copy out code and state

Cons:

• not a full OAuth app backend; you still need to exchange the code for tokens yourself
• weaker fit for repeated development flows and team usage
• the authorization code is sensitive, so only use this for short-lived development testing and avoid shared or long-lived capture URLs

Practical recommendation:

• use plain localhost if you only need a one-off auth code and are fine copying it manually
• use ngrok if you are building a real integration or expect to repeat the flow
• use webhook.site only for quick one-off testing when you do not yet have a callback handler

Step 2: Configure Zoom MCP Scopes

Add the MCP-specific granular scopes required by the tools you want to use.

Minimum recommendation for the main Zoom MCP connector:

• use a General app
• use user-level OAuth
• include the 7 main MCP scopes above on the same app

For the dedicated Zoom Docs MCP connector:

• add docs:write:import if you want Docs creation
• add docs:read:export if you want Docs retrieval
• export the resulting token as ZOOM_DOCS_MCP_ACCESS_TOKEN

Whiteboard MCP uses a separate scope set. See ../whiteboard/SKILL.md.

Step 3: Authorize and Exchange for Tokens

1. Construct the authorization URL:

   Copy

   https://zoom.us/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI

2. Sign in as the Zoom user who should authorize the app and approve the requested scopes.
3. Copy the code from the redirect URL.
4. Exchange the code for tokens:

   bashCopy

   curl -X POST https://zoom.us/oauth/token \
     -u "CLIENT_ID:CLIENT_SECRET" \
     -d "grant_type=authorization_code&code=CODE&redirect_uri=REDIRECT_URI"

5. Store the returned access_token and refresh_token.

Treat the refresh token as single-use:

• every successful refresh can return a new refresh token
• persist the newly returned refresh token atomically with the new access token
• stop using the old refresh token after a successful refresh
• avoid concurrent refresh requests against the same stored token

If you used webhook.site, the callback will arrive as a captured request and the code parameter will be in the query string. Exchange it immediately and do not keep using the same capture URL longer than necessary.

Step 4: Enable AI Companion Features

Smart Recording and Meeting Summary are feature prerequisites for useful semantic meeting search, meeting assets, and transcript-rich recording content.

In the Zoom web portal:

1. Go to Admin → Account Management → Account Settings → AI Companion.
2. Enable Smart Recording.
3. Enable Meeting Summary.

Important:

• these settings do not replace the OAuth scopes above
• they affect whether useful recap and transcript content exists for MCP retrieval

Step 5: Provide the Token to the Bundled MCP Connector

Export the token environment variable used by this plugin:

Verification:

• restart Claude Code or re-enable the plugin so the bundled MCP server restarts with the token
• confirm the client can see recordings_list, search_meetings, get_meeting_assets, and get_recording_resource
• for the dedicated Docs server, confirm the client can see create_file_with_content and get_file_content
• if your client exposes protocol inspection, use tools/list as the authority for the live catalog
• run a simple tool such as recordings_list to verify the token has the correct MCP scopes

Token Lifecycle

Refresh exchange:

After a successful refresh:

• replace the stored access token
• replace the stored refresh token
• treat the previously used refresh token as spent
• restart Claude Code or re-enable the plugin if you are injecting tokens through env vars

Environment Variables

See also: ../../oauth/SKILL.md