ZTA LabFree University

T1 · T1-R03 · Zoom Workplace

Zoom API access, one hour at a time

Account-wide automation and a user-consented app are different grants. The page says OAuth uses an authorization code that you exchange for a token, and server-to-server OAuth uses app credentials to request a token directly. Refresh the user token, or request a new server-to-server token, when the hour ends.

ExportSVGFlowSheet

Learn it in 5 minutes

  • The API reference says to obtain an access token with OAuth or server-to-server authentication.
  • Requests go to the base URL https://api.zoom.us/v2/ with the token in the Authorization header.
  • Methods named on that page are GET, POST, PATCH, PUT, and DELETE.
  • The page says both OAuth styles provide access tokens valid for one hour.
  • The sample token response on the page includes expires_in 3599.

Visual

Zoom API access, one hour at a time API. Teaching sketch. Confirm a live system. OAuth api.zoom.us 1 hour scope Names come from pages opened in 2026-10. A missing name stays confirm.

Count the boxes: 4. Each label is a name from a page or a study label marked on the drawing.

Flow

Zoom API access, one hour at a time Caller SIP Called session setup session setup RTP, not required to hairpin Teaching sketch from RFC 3261 and RFC 3550. Not a packet capture.

What is going on

Account-wide automation and a user-consented app are different grants. The page says OAuth uses an authorization code that you exchange for a token, and server-to-server OAuth uses app credentials to request a token directly. Refresh the user token, or request a new server-to-server token, when the hour ends.

The sample is an illustration on the docs page. It is not a credential. This lab does not store client secrets, and you should not paste one into a study note.

Workplace and Zoom CX both appear in the API navigation. A token's scope, shown in the sample as a field named scope, decides what that token can call. The sample value user:read is an example on the page, not your app's scope.

Worked example

Write the base URL, the header name, and the lifetime you read (one hour, and the sample expires_in 3599). Stop before you invent a scope. Open your app's scope list in the Zoom console you administer, which this lab cannot see.

Quiz

1. The API reference sample shows expires_in 3599.

2. A study note should include a client secret so the next reader can call the API.

Ecosystem

Sister pieces sit on the ecosystem page: the glossary, the mind map, the integration map, and the bridges.

  • Access token — The credential the Zoom API reference says to send in the Authorization header.
  • Server-to-server OAuth — The grant the page describes for requesting a token with app credentials, without a user consent code.

Config. Record the base URL and the grant type. Leave the secret in the admin console.

Troubleshooting. A call that worked an hour ago and now returns an auth error matches the lifetime the page states. Refresh before you blame the dial plan.

Bridge. Phone, Contact Center, and Virtual Agent docs sit on the same developer site. They still name their own guides.

Mind map, sister technologies, and future hooks live on the ecosystem page.

Sources and go deeper

Opened 2026-10. A row marked confirm has no link, because that page was not verified.

sources.json Markdown