# Zoom: OAuth app setup and approval Reviewed · Sourced · updated 27 Oct 2026 · https://oauth-guide.akshatsethi.com/apps/zoom > Your own Zoom account can connect within an hour of creating a General app in the Zoom App Marketplace. Before users outside your account can connect, the app has to pass Zoom's Marketplace review, which covers functionality, compliance and security. Forum reports put that at 2 to 12 weeks. - **Your hands-on work:** 1–4 days - **Waiting on Zoom:** 2–12 weeks - **First user can connect:** Today, in about 30 to 60 minutes - **Why Reviewed:** An unpublished app can only be installed by your own Zoom account, plus a small approved beta group. Publishing it, even as unlisted, requires Zoom's functional and security review. - **Using Composio?** Composio has a managed Zoom OAuth app, so you can prototype without passing Zoom's review yourself. Before launch, register and publish your own app so your name appears on the consent screen. ## Path to launch ### Build: Your Zoom account - Who can connect: Users in your own Zoom account, through Local Test or the authorization URL - What users see: The normal Zoom authorization screen for your unpublished app - Effort: 30–60 min · Wait: None - Next: Complete the production build-flow requirements and ask Zoom to approve beta sharing outside your account - _(Docs [2, 5])_ ### Beta: Beta testers - Who can connect: A limited number of users outside your account, using a Zoom-approved authorization URL - What users see: The Zoom authorization screen for a beta app. It isn't listed in the Marketplace. - Effort: 1–3 h · Wait: 3–4 days - Next: Submit the app for publishing and pass Zoom's Marketplace review - _(Docs [5], medium confidence)_ ### Launch: Published app - Who can connect: Any Zoom user, either through a public Marketplace listing or an unlisted link - What users see: The standard Zoom authorization screen showing your app's name and requested scopes - Effort: 1–3 days · Wait: 2–12 weeks - _(Community [3, 7, 8], medium confidence)_ ## Before you start - [ ] **A Zoom account with developer permissions** (You). You must be the account owner or an admin, or have the Zoom for developers role, to see the Develop menu in the Marketplace. On a free account, Zoom asks you to add a credit card or fill in a developer information form before you can submit for review. _(Docs [2, 6])_ - [ ] **Your redirect URI and allow-listed domain** (Agent). The build flow requires a development redirect URL and an OAuth allow list containing that URL or its base domain. Production needs its own redirect URL. _(Docs [2])_ - [ ] **Privacy policy, terms, support and documentation pages on your own domain** (You). These pages must be hosted on a domain your company owns. Google Drive and Dropbox links are rejected. Your documentation must explain how to add the app, use it and remove it, including what happens to user data after removal. _(Docs [6])_ - [ ] **A support page** (You). It should list support hours, a first-response SLA, and a way to open a case or email support. _(Docs [6])_ - [ ] **A test plan and test accounts** (You). Give step-by-step testing instructions for each scope, as a document or a demo video. If your app needs specific data to test, include credentials for two user roles. _(Docs [6])_ - [ ] **Technical design and security information** (You). In the build flow you describe your architecture, security controls and how you use scopes. Some developers report being asked for supporting evidence such as SSDLC documentation and SAST/DAST results. _(Docs [3, 8], medium confidence)_ - [ ] **Deauthorization handling** (Agent). Either use Zoom's standard removal flow, or handle the deauthorization event and call the token revoke endpoint. _(Docs [6])_ ## Steps 1. **Create a General app in the Zoom Marketplace** (You, 5–10 min). Sign in to marketplace.zoom.us, then go to Develop > Build App > General app. Choose User-managed if each user authorizes their own data, or Admin-managed if account admins install the app for their whole account. _(Docs [2])_ - Sign in at marketplace.zoom.us - Open Develop > Build App > General app - Name the app and choose User-managed or Admin-managed - Agent: A person must sign in. After that, an agent can fill in the basic information. - Watch out: If you change the management type later, the available scopes change, so you'll need to recheck them. 2. **Set the redirect URL and OAuth allow list** (Agent, 5–10 min). Enter your redirect URI as the development redirect URL, and add it or its base domain to the OAuth allow list. Do the same for production when you get there. _(Docs [2])_ - Paste your redirect URI into the OAuth Redirect URL field - Add the URI or its domain to the OAuth allow list - Agent: An agent can fill in these fields. - Watch out: If you leave the allow list empty or it doesn't match your redirect URI, authorization fails. 3. **Copy the client ID and secret into your OAuth client** (You, 5 min). The build flow shows separate development and production client IDs and secrets. Use the development pair while testing. _(Docs [2])_ - Copy the development client ID and client secret - Store them in your OAuth client's configuration - Agent: Hand back to a person here. The agent must not handle the client secret. - Watch out: Production credentials only work for installs of the published or beta app. Development credentials only work in your own account. 4. **Add scopes with justifications** (Agent, 10–30 min). On the Scopes page, add only the granular scopes you need, such as meeting or user read scopes, and write a reason for each one. Reviewers reject scopes that are unused or redundant. _(Docs [2, 6])_ - Open Scopes > Add Scopes - Select the products and scopes you need - Write a description for each scope - Agent: An agent can choose scopes based on the API calls your app makes. - Watch out: Requesting a view scope when you already have the matching manage scope gets the extra one flagged as redundant. 5. **Install the app on your account via Local Test** (Agent, 5–10 min). On Local Test, click Add App Now and allow access. Or start authorization from your OAuth client. This works for any user in your Zoom account. _(Docs [2])_ - Click Add App Now on the Local Test page - Approve the consent screen - Confirm your OAuth client receives tokens - Agent: An agent can run the test. A person may need to approve the consent screen. 6. **Request approval to share the beta outside your account** (You, 30–60 min). Fill in the production build-flow requirements. The Beta Test tab then generates an authorization URL. Zoom must approve sharing it outside your account, and only a limited number of users can install it. _(Docs [5], medium confidence)_ - Complete the production build flow - Open Beta Test > Share App and request external sharing - Agent: An agent can fill in the build-flow fields. A person submits the request. - Watch out: When the app is published, beta authorization URLs stop working. Test changes on the development side. 7. **Wait for Zoom to approve beta sharing** (Provider, wait 3–4 days). Zoom's app review team usually responds in 3 to 4 business days, or longer if they need clarification. _(Docs [5], medium confidence)_ 8. **Prepare the listing, docs and test plan** (You, 1–3 days). Fill in the app listing (description, images, categories), the URLs for your documentation, privacy policy, terms and support pages on your own domain, the technical design section, the production redirect URI, and a test plan with test accounts. _(Docs [6, 7])_ - Publish documentation, support, privacy and terms pages on your domain - Write a test plan or record a demo video, and link it in the Release Notes - Fill in the Technical Design and security sections - Set up deauthorization handling - Agent: An agent can draft the listing text and fill in form fields. A person writes the policies and attests to security. - Watch out: Incomplete listing information causes most rejections. Unlisted apps still need images and descriptions. 9. **Submit the app for publishing** (You, 10–20 min). Submit from the build flow, and choose public listing or unlisted. Both go through the full review. _(Docs [3, 4])_ - Choose public or unlisted - Submit for review - Agent: A person must submit. 10. **Wait for functional and security review** (Provider, wait 2–12 weeks). Zoom checks your listing, functionality and compliance, then reviews your technical design, evaluates your scopes and tests for OWASP Top 10 issues. If the app is rejected, you get a report and can resubmit after fixing the issues. _(Community [3, 7, 8], medium confidence)_ - Watch out: Each round of fixes adds time. Respond quickly to reviewer findings. ## Scopes Zoom uses granular scopes, such as meeting:read and user:read variants, and doesn't publish sensitivity tiers. Every requested scope needs a written justification and test instructions, and the security review may remove any scope your app doesn't clearly use. | Scope | Grants | Level | Consequence | |---|---|---|---| | `Any scope your app requests` | Access to the Zoom product data that scope covers | basic | Checked during the Marketplace security review. Unused or redundant scopes get denied. | ## When you get stuck - **Users outside your Zoom account can't install the app.** Unpublished (private) apps can only be installed by members of your own account. Fix: Get Zoom's approval for beta sharing, or publish the app through review. _(Docs [2, 5])_ - **Review is rejected for metadata or URLs.** Docs are hosted on Google Drive, the support page or removal instructions are missing, or the listing is incomplete. Fix: Host every page on your own domain and follow the rejection checklist. _(Docs [6, 7])_ - **Rejection asks for supporting evidence for the technical design.** The security attestation didn't include documentation such as SSDLC or SAST/DAST results. Fix: Attach your security policy and testing evidence when you submit. _(Community [8], low confidence)_ ## Not confirmed yet - **How many outside users can a beta app have?** The docs only say 'a limited number'. To resolve: Ask Zoom when you request beta sharing, or ask on devforum.zoom.us. - **Current typical review time** Forum estimates range from 2 to 4 weeks to 4 to 12 weeks, and Zoom publishes no official SLA. To resolve: Ask on devforum.zoom.us or ask your Zoom partner contact. ## Sources 1. [Composio managed auth toolkits](https://docs.composio.dev/toolkits/managed-auth.md) (Composio docs). Checked 27 Oct 2026 2. [Create a general app](https://developers.zoom.us/docs/integrations/create/) (Zoom Developer docs). Checked 27 Oct 2026 3. [App Review Process](https://developers.zoom.us/docs/distribute/app-review-process/) (Zoom Developer docs). Checked 27 Oct 2026 4. [App distribution](https://developers.zoom.us/docs/distribute.md) (Zoom Developer docs). Checked 27 Oct 2026 5. [Sharing Private and Beta Apps](https://developers.zoom.us/docs/distribute/sharing-private-and-beta-apps/) (Zoom Developer docs). Not yet checked 6. [Common reasons for app submission rejection](https://developers.zoom.us/docs/distribute/app-submission/common-rejection-issues/) (Zoom Developer docs). Checked 27 Oct 2026 7. [Is there a way to allow users to use Zoom now / length of verification process?](https://devforum.zoom.us/t/is-there-a-way-to-allow-users-to-use-zoom-now-length-of-verification-process/132859) (Zoom Developer Forum). Checked 27 Oct 2026 8. [Time required to Publish the app in Zoom marketplace](https://community.zoom.com/marketplace-10/time-required-to-publish-the-app-in-zoom-marketplace-58780) (Zoom Community). Checked 27 Oct 2026 Wrong or out of date? POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "zoom", "step": 2, "message": "what you saw"} (step is optional), or call the report_problem MCP tool. The next research run checks it. Followed it? Say how it went: POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "zoom", "outcome": "worked" | "waiting" | "stuck", "step": 3, "message": "what happened"}, or call the report_setup MCP tool.