Security Overview

App builder for agents is a server-side OAuth and MCP integration. Raw Zoom OAuth tokens remain on the server; Marketplace API results are returned only to authenticated MCP clients or API-key-protected REST callers.

Access Control

The MCP endpoint requires helper-issued OAuth bearer tokens and uses PKCE during authorization. The separate administrative REST wrapper requires a server-side API key. Zoom account access requires OAuth authorization from an eligible Zoom account admin.

Data Handling

The app stores Zoom OAuth access and refresh tokens, account identifiers, granted scopes, and limited integration metadata in a private SQLite database so it can call Zoom Marketplace APIs for the authorizing account. The database is outside the web root, is written with owner-only 0600 permissions, and its application state is encrypted with AES-256-GCM. The underlying storage is also encrypted. The application encryption key is supplied through deployment secrets.

Secrets

Do not commit client secrets, refresh tokens, signing secrets, verification tokens, or webhook secret tokens. Use local environment configuration or a production secret manager.

Deauthorization

Zoom deauthorization notifications are accepted only when the x-zm-signature HMAC matches the configured webhook Secret Token and the request timestamp is recent. A verified event removes the affected account's installation and all associated helper OAuth grants.

Report a Security Issue

Report Marketplace integration issues through the Zoom Marketplace Developer Forum. Do not post account identifiers, secrets, or tokens publicly.