Skip to main content

Zoom

Use a Zoom OAuth app when a Zoom MCP integration asks for a Zoom Client ID and Client Secret.

See Overview for prerequisites and secret-handling guidance.

Create The Zoom OAuth App​

  1. Decide which Zoom account should own the integration. You need developer or admin authorization on that account to create and activate the app.
  2. Log in to the Zoom App Marketplace at marketplace.zoom.us as a developer or admin.
  3. Click Develop, then Build App.
  4. Select General App and click Create. A General App uses user-managed OAuth 2.0, which is the authorization model Zoom's remote MCP servers use.
  5. Open Basic Information. Under App Credentials, locate the Client ID and Client Secret. Zoom provides separate Development and Production credentials, so use the set that matches your environment.
  6. Under OAuth Information, paste the QuilrAI callback URL into the OAuth Redirect URL field, then add the same URL to the OAuth Allow List. Copy the callback URL from the QuilrAI MCP setup screen and match it exactly.
  7. Open Scopes and add the scopes listed in Required Scopes For The Main Zoom MCP Server. The main Zoom MCP server, the Docs server, and the Whiteboard server can expose different scope sets, so use the list for the specific server you are enabling.
  8. Activate the app. Zoom cannot issue tokens for an app that is not activated.
  9. Copy the Client ID and Client Secret from App Credentials.
  10. Paste the Client ID and Client Secret into the QuilrAI manual OAuth setup screen, then click Connect and authorize Zoom. Zoom completes the OAuth 2.1 authorization-code flow with PKCE, and access is scoped to the authorizing user's own Zoom permissions.

Required Scopes For The Main Zoom MCP Server​

For the complete tool set exposed by Zoom's main remote MCP server at https://mcp.zoom.us/mcp/zoom/streamable, add all of the following granular scopes to the Zoom General App.

Read scopes:

  • my_notes:read:content
  • meeting:read:assets
  • meeting:read:search
  • agentic_search:read:ask
  • agentic_search:read:search
  • cloud_recording:read:list_user_recordings
  • cloud_recording:read:content
  • docs:read:export
  • hub:read:content

Write scopes:

  • docs:write:import
  • hub:write:content

Zoom publishes the current list in its OAuth protected-resource metadata. If Zoom changes that metadata, update the General App to match before enabling new tools.

Older ai_companion:read:ask and ai_companion:read:search grants do not replace agentic_search:read:ask and agentic_search:read:search. Similarly, cloud_recording:read:meeting_transcript does not grant permission to list or read cloud recordings.

After adding or changing scopes, each user must reconnect Zoom and approve the updated consent request. Refreshing an existing token does not add newly configured scopes.

Keep In Mind​

  • Zoom remote MCP servers do not support Dynamic Client Registration, so you must create a provider-owned OAuth app and enter the Client ID and Client Secret manually.
  • A General App uses user-managed OAuth. Each user authorizes individually, and access is limited to that user's own Zoom permissions, so per-user authorization is enforced by Zoom rather than by a single shared service identity.
  • Zoom apps provide separate Development and Production credentials and redirect URLs. Create a separate app, or use the matching credential set, for each QuilrAI environment whose callback URL differs.
  • The app must be activated in Zoom before tokens can be issued. If the app is later deactivated, existing tokens stop working.
  • If your Zoom account restricts app installs, an account admin may need to approve the app before users can authorize it.
  • For account-level automation that runs without a signed-in user, create a Server-to-Server OAuth app instead and use the account-credentials flow. The standard MCP path is the user-managed General App described above.

Troubleshooting​

ErrorLikely causeFix
redirect_uri_mismatch, invalid_redirect, or failed callbackThe Zoom OAuth Redirect URL or OAuth Allow List entry does not match the QuilrAI callback URL.Copy the callback URL from QuilrAI again, update both the Redirect URL and the OAuth Allow List in Zoom, save, and retry.
invalid_client or bad_client_secretWrong Client ID, wrong secret, mismatched Development and Production credentials, or app not activated.Copy the Zoom Client ID and Client Secret again for the correct environment, confirm the app is activated, update QuilrAI, and retry.
Consent succeeds but tools are missingThe app was authorized with narrower scopes than the tools need.Add the missing Zoom scopes, reconnect, and re-fetch capabilities.
invalid_grant when refreshingThe user revoked authorization, or the Client Secret was rotated.Reconnect to re-authorize. After rotating the secret, update the QuilrAI manual OAuth credentials.

References​

On this page