| name | zoom-oauth |
| description | Use when implementing OAuth. |
Zoom OAuth
Use this skill for concrete Zoom authentication implementation and troubleshooting. Prefer setup-zoom-oauth for the first-pass setup plan, then return here for exact flows, scope behavior, refresh handling, and error diagnosis.
Workflow
- Identify the app type and actor: user-level OAuth, account-level OAuth, server-to-server OAuth where officially supported, SDK JWT, or Build-platform credentials.
- Confirm the target API, SDK, or app surface, because scopes and token audiences differ by surface.
- Choose the grant flow: authorization code with PKCE for public clients, authorization code for confidential web apps, device authorization where appropriate, or account credentials for supported account-level automation.
- Store refresh tokens as single-use values: persist the replacement refresh token returned by each refresh response before reusing the old one.
- Validate requests against redirect URI, account ID, scopes, app publication state, and token expiration before changing application code.
- For local development, keep access tokens out of logs and treat refresh tokens as single-use when rotating credentials.
References
