{"slug":"zoom","name":"Zoom","domain":"zoom.us","category":"Video meetings","summary":"Your own Zoom account can connect within an hour of creating a General app in the Zoom App Marketplace. Before users outside your account can connect, the app has to pass Zoom's Marketplace review, which covers functionality, compliance and security. Forum reports put that at 2 to 12 weeks.","tier":"reviewed","tierReason":"An unpublished app can only be installed by your own Zoom account, plus a small approved beta group. Publishing it, even as unlisted, requires Zoom's functional and security review.","quality":"researched","updatedAt":"2026-10-27","composio":{"status":"managed","note":"Composio has a managed Zoom OAuth app, so you can prototype without passing Zoom's review yourself. Before launch, register and publish your own app so your name appears on the consent screen.","toolkit":"ZOOM"},"totals":{"effort":{"min":1,"max":4,"unit":"days"},"wait":{"min":2,"max":12,"unit":"weeks"},"firstConnection":"Today, in about 30 to 60 minutes"},"stages":[{"id":"build","name":"Your Zoom account","whoCanConnect":"Users in your own Zoom account, through Local Test or the authorization URL","userSees":"The normal Zoom authorization screen for your unpublished app","effort":{"min":30,"max":60,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Complete the production build-flow requirements and ask Zoom to approve beta sharing outside your account","evidence":{"kind":"docs","sources":["s2","s5"],"confidence":"high"}},{"id":"beta","name":"Beta testers","whoCanConnect":"A limited number of users outside your account, using a Zoom-approved authorization URL","userSees":"The Zoom authorization screen for a beta app. It isn't listed in the Marketplace.","effort":{"min":1,"max":3,"unit":"hours"},"wait":{"min":3,"max":4,"unit":"days"},"unlock":"Submit the app for publishing and pass Zoom's Marketplace review","evidence":{"kind":"docs","sources":["s5"],"confidence":"medium"}},{"id":"launch","name":"Published app","whoCanConnect":"Any Zoom user, either through a public Marketplace listing or an unlisted link","userSees":"The standard Zoom authorization screen showing your app's name and requested scopes","effort":{"min":1,"max":3,"unit":"days"},"wait":{"min":2,"max":12,"unit":"weeks"},"unlock":null,"evidence":{"kind":"community","sources":["s3","s7","s8"],"confidence":"medium"}}],"requirements":[{"id":"zoom-account-role","label":"A Zoom account with developer permissions","detail":"You must be the account owner or an admin, or have the Zoom for developers role, to see the Develop menu in the Marketplace. On a free account, Zoom asks you to add a credit card or fill in a developer information form before you can submit for review.","stage":"build","actor":"you","evidence":{"kind":"docs","sources":["s2","s6"],"confidence":"high"}},{"id":"https-redirect","label":"Your redirect URI and allow-listed domain","detail":"The build flow requires a development redirect URL and an OAuth allow list containing that URL or its base domain. Production needs its own redirect URL.","stage":"build","actor":"agent","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"owned-domain-docs","label":"Privacy policy, terms, support and documentation pages on your own domain","detail":"These pages must be hosted on a domain your company owns. Google Drive and Dropbox links are rejected. Your documentation must explain how to add the app, use it and remove it, including what happens to user data after removal.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s6"],"confidence":"high"}},{"id":"support-page","label":"A support page","detail":"It should list support hours, a first-response SLA, and a way to open a case or email support.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s6"],"confidence":"high"}},{"id":"test-plan","label":"A test plan and test accounts","detail":"Give step-by-step testing instructions for each scope, as a document or a demo video. If your app needs specific data to test, include credentials for two user roles.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s6"],"confidence":"high"}},{"id":"tech-design","label":"Technical design and security information","detail":"In the build flow you describe your architecture, security controls and how you use scopes. Some developers report being asked for supporting evidence such as SSDLC documentation and SAST/DAST results.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s3","s8"],"confidence":"medium"}},{"id":"deauth","label":"Deauthorization handling","detail":"Either use Zoom's standard removal flow, or handle the deauthorization event and call the token revoke endpoint.","stage":"launch","actor":"agent","evidence":{"kind":"docs","sources":["s6"],"confidence":"high"}}],"steps":[{"id":"open-build-flow","title":"Create a General app in the Zoom Marketplace","actor":"you","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Sign in to marketplace.zoom.us, then go to Develop > Build App > General app. Choose User-managed if each user authorizes their own data, or Admin-managed if account admins install the app for their whole account.","actions":["Sign in at marketplace.zoom.us","Open Develop > Build App > General app","Name the app and choose User-managed or Admin-managed"],"agentNote":"A person must sign in. After that, an agent can fill in the basic information.","gotcha":"If you change the management type later, the available scopes change, so you'll need to recheck them.","link":{"label":"Zoom App Marketplace","url":"https://marketplace.zoom.us/"},"evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"configure-oauth","title":"Set the redirect URL and OAuth allow list","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Enter your redirect URI as the development redirect URL, and add it or its base domain to the OAuth allow list. Do the same for production when you get there.","actions":["Paste your redirect URI into the OAuth Redirect URL field","Add the URI or its domain to the OAuth allow list"],"agentNote":"An agent can fill in these fields.","gotcha":"If you leave the allow list empty or it doesn't match your redirect URI, authorization fails.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"copy-credentials","title":"Copy the client ID and secret into your OAuth client","actor":"you","stage":"build","time":{"min":5,"max":5,"unit":"minutes"},"detail":"The build flow shows separate development and production client IDs and secrets. Use the development pair while testing.","actions":["Copy the development client ID and client secret","Store them in your OAuth client's configuration"],"agentNote":"Hand back to a person here. The agent must not handle the client secret.","gotcha":"Production credentials only work for installs of the published or beta app. Development credentials only work in your own account.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"add-scopes","title":"Add scopes with justifications","actor":"agent","stage":"build","time":{"min":10,"max":30,"unit":"minutes"},"detail":"On the Scopes page, add only the granular scopes you need, such as meeting or user read scopes, and write a reason for each one. Reviewers reject scopes that are unused or redundant.","actions":["Open Scopes > Add Scopes","Select the products and scopes you need","Write a description for each scope"],"agentNote":"An agent can choose scopes based on the API calls your app makes.","gotcha":"Requesting a view scope when you already have the matching manage scope gets the extra one flagged as redundant.","evidence":{"kind":"docs","sources":["s2","s6"],"confidence":"high"}},{"id":"local-test","title":"Install the app on your account via Local Test","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"On Local Test, click Add App Now and allow access. Or start authorization from your OAuth client. This works for any user in your Zoom account.","actions":["Click Add App Now on the Local Test page","Approve the consent screen","Confirm your OAuth client receives tokens"],"agentNote":"An agent can run the test. A person may need to approve the consent screen.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"request-beta","title":"Request approval to share the beta outside your account","actor":"you","stage":"beta","time":{"min":30,"max":60,"unit":"minutes"},"detail":"Fill in the production build-flow requirements. The Beta Test tab then generates an authorization URL. Zoom must approve sharing it outside your account, and only a limited number of users can install it.","actions":["Complete the production build flow","Open Beta Test > Share App and request external sharing"],"agentNote":"An agent can fill in the build-flow fields. A person submits the request.","gotcha":"When the app is published, beta authorization URLs stop working. Test changes on the development side.","link":{"label":"Sharing private and beta apps","url":"https://developers.zoom.us/docs/distribute/sharing-private-and-beta-apps/"},"evidence":{"kind":"docs","sources":["s5"],"confidence":"medium"}},{"id":"beta-approval","title":"Wait for Zoom to approve beta sharing","actor":"provider","stage":"beta","time":{"min":3,"max":4,"unit":"days"},"detail":"Zoom's app review team usually responds in 3 to 4 business days, or longer if they need clarification.","evidence":{"kind":"docs","sources":["s5"],"confidence":"medium"}},{"id":"prepare-listing","title":"Prepare the listing, docs and test plan","actor":"you","stage":"launch","time":{"min":1,"max":3,"unit":"days"},"detail":"Fill in the app listing (description, images, categories), the URLs for your documentation, privacy policy, terms and support pages on your own domain, the technical design section, the production redirect URI, and a test plan with test accounts.","actions":["Publish documentation, support, privacy and terms pages on your domain","Write a test plan or record a demo video, and link it in the Release Notes","Fill in the Technical Design and security sections","Set up deauthorization handling"],"agentNote":"An agent can draft the listing text and fill in form fields. A person writes the policies and attests to security.","gotcha":"Incomplete listing information causes most rejections. Unlisted apps still need images and descriptions.","link":{"label":"Common rejection reasons","url":"https://developers.zoom.us/docs/distribute/app-submission/common-rejection-issues/"},"evidence":{"kind":"docs","sources":["s6","s7"],"confidence":"high"}},{"id":"submit-review","title":"Submit the app for publishing","actor":"you","stage":"launch","time":{"min":10,"max":20,"unit":"minutes"},"detail":"Submit from the build flow, and choose public listing or unlisted. Both go through the full review.","actions":["Choose public or unlisted","Submit for review"],"agentNote":"A person must submit.","link":{"label":"App review process","url":"https://developers.zoom.us/docs/distribute/app-review-process/"},"evidence":{"kind":"docs","sources":["s3","s4"],"confidence":"high"}},{"id":"zoom-review","title":"Wait for functional and security review","actor":"provider","stage":"launch","time":{"min":2,"max":12,"unit":"weeks"},"detail":"Zoom checks your listing, functionality and compliance, then reviews your technical design, evaluates your scopes and tests for OWASP Top 10 issues. If the app is rejected, you get a report and can resubmit after fixing the issues.","gotcha":"Each round of fixes adds time. Respond quickly to reviewer findings.","evidence":{"kind":"community","sources":["s3","s7","s8"],"confidence":"medium"}}],"scopes":{"intro":"Zoom uses granular scopes, such as meeting:read and user:read variants, and doesn't publish sensitivity tiers. Every requested scope needs a written justification and test instructions, and the security review may remove any scope your app doesn't clearly use.","tiers":[{"scope":"Any scope your app requests","grants":"Access to the Zoom product data that scope covers","level":"basic","consequence":"Checked during the Marketplace security review. Unused or redundant scopes get denied."}]},"blockers":[{"symptom":"Users outside your Zoom account can't install the app","cause":"Unpublished (private) apps can only be installed by members of your own account.","fix":"Get Zoom's approval for beta sharing, or publish the app through review.","evidence":{"kind":"docs","sources":["s2","s5"],"confidence":"high"}},{"symptom":"Review is rejected for metadata or URLs","cause":"Docs are hosted on Google Drive, the support page or removal instructions are missing, or the listing is incomplete.","fix":"Host every page on your own domain and follow the rejection checklist.","evidence":{"kind":"docs","sources":["s6","s7"],"confidence":"high"}},{"symptom":"Rejection asks for supporting evidence for the technical design","cause":"The security attestation didn't include documentation such as SSDLC or SAST/DAST results.","fix":"Attach your security policy and testing evidence when you submit.","evidence":{"kind":"community","sources":["s8"],"confidence":"low"}}],"unknowns":[{"question":"How many outside users can a beta app have?","why":"The docs only say 'a limited number'.","resolve":"Ask Zoom when you request beta sharing, or ask on devforum.zoom.us."},{"question":"Current typical review time","why":"Forum estimates range from 2 to 4 weeks to 4 to 12 weeks, and Zoom publishes no official SLA.","resolve":"Ask on devforum.zoom.us or ask your Zoom partner contact."}],"handoff":{"agentCan":["Fill in the app's basic info, redirect URL and allow list","Choose scopes and write their justifications","Run Local Test installs","Draft the listing text and test plan"],"youMust":["Sign in with an admin or developer role","Handle the client secret","Write and host the policy, support and documentation pages","Submit for beta sharing and for publishing","Respond to reviewer findings"]},"sources":[{"id":"s1","title":"Composio managed auth toolkits","url":"https://docs.composio.dev/toolkits/managed-auth.md","publisher":"Composio docs","kind":"composio","checkedAt":"2026-10-27"},{"id":"s2","title":"Create a general app","url":"https://developers.zoom.us/docs/integrations/create/","publisher":"Zoom Developer docs","kind":"official","checkedAt":"2026-10-27"},{"id":"s3","title":"App Review Process","url":"https://developers.zoom.us/docs/distribute/app-review-process/","publisher":"Zoom Developer docs","kind":"official","checkedAt":"2026-10-27"},{"id":"s4","title":"App distribution","url":"https://developers.zoom.us/docs/distribute.md","publisher":"Zoom Developer docs","kind":"official","checkedAt":"2026-10-27"},{"id":"s5","title":"Sharing Private and Beta Apps","url":"https://developers.zoom.us/docs/distribute/sharing-private-and-beta-apps/","publisher":"Zoom Developer docs","kind":"search","checkedAt":null},{"id":"s6","title":"Common reasons for app submission rejection","url":"https://developers.zoom.us/docs/distribute/app-submission/common-rejection-issues/","publisher":"Zoom Developer docs","kind":"official","checkedAt":"2026-10-27"},{"id":"s7","title":"Is there a way to allow users to use Zoom now / length of verification process?","url":"https://devforum.zoom.us/t/is-there-a-way-to-allow-users-to-use-zoom-now-length-of-verification-process/132859","publisher":"Zoom Developer Forum","kind":"community","checkedAt":"2026-10-27"},{"id":"s8","title":"Time required to Publish the app in Zoom marketplace","url":"https://community.zoom.com/marketplace-10/time-required-to-publish-the-app-in-zoom-marketplace-58780","publisher":"Zoom Community","kind":"search","checkedAt":"2026-10-27"}],"feedback":{}}