verapli
Sign inJoin free
Menu

Guides · messaging · Popular APIs

Zoom App Marketplace app (General app or Server-to-Server OAuth)

Build a Server-to-Server OAuth app for your own account, or a General (OAuth) app for other Zoom users; public or unlisted General apps must pass Zoom's App Marketplace review including a security review.

Researched · not yet run liveLast researched 25 October 2026 · Zoom · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Apps are built under a Zoom account in the App Marketplace; S2S apps act on that account only.

  • Zoom account organisationYour role must allow creating Server-to-Server OAuth apps and granting admin-level scopes.

Have ready

  • Technical design documentation (architecture, security controls, use of each scope) for review [3]Needed for: Submit for App Marketplace review (public/unlisted)

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create a Server-to-Server OAuth app (your own account)optional

    Develop > Build an app > Server-to-Server OAuth; add scopes your role allows and the developer contact name and email.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://marketplace.zoom.us/develop/create

  2. Activate and copy credentials

    Fix any activation errors and Activate; then copy the account ID, client ID and secret. Tokens can't be generated until the app is active.

    • verapli co-pilot
    • Human step: You press submit
    • After: Create a Server-to-Server OAuth app (your own account)

    verapli captures ZOOM_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    Where: https://marketplace.zoom.us/user/build

  3. Create a General app (other users' accounts)optional

    Build an app > General app; choose admin-managed or user-managed; enter redirect URL and allow list; add scopes with a reason for each; test with Local Test using development credentials.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://marketplace.zoom.us/develop/create

  4. Submit for App Marketplace review (public/unlisted)optional

    Complete the Technical Design section and listing, then submit. Zoom checks completeness and branding, functionality and compliance, then runs a security review (scopes, OWASP Top 10 testing). Switch to production credentials on approval.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Create a General app (other users' accounts)
    The provider says
    No fixed timeline; depends on app quality, number of features, scope clarity and listing information. [3]
    If something goes wrong (1)
    • Review rejected with a remediation report: Complete every action item in the report and resubmit. [3]

    Where: https://marketplace.zoom.us/user/build

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Zoom's security review may reject scopes it considers unnecessary; request the minimum and describe why. [1]

Worth knowingThe rules say

Published apps are monitored and may be temporarily removed if they pose significant risk. [3]

What you end up with

Env varSecretFormatWhat it is
ZOOM_ACCOUNT_IDnot secretopaque id stringAccount ID (Server-to-Server OAuth)
ZOOM_CLIENT_IDnot secretopaque id stringApp client ID (development or production)
ZOOM_CLIENT_SECRETsecretopaque secret stringApp client secret

Pricing

  • No fee to build apps stated on the pages reviewed [to verify]; API availability depends on the Zoom account plan [to verify].

Source [1]

For agents

The same entry as JSON: /api/v1/entries/zoom/app-marketplace · requirements /api/v1/requirements/zoom/app-marketplace · terms /api/v1/terms/zoom/app-marketplace.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Zoom App Marketplace app (General app or Server-to-Server OAuth), and how long will it take?"
  → tools/call requirements { "provider_id": "zoom/app-marketplace" }

Sources

  1. Create an OAuth app Marketplace > Develop > Build an app > General app; admin-managed vs user-managed; redirect URL and allow list; development vs production client ID/secret; scopes with descriptions (Security Review may reject unnecessary ones); Local Test; beta apps limited to the developer's account. · accessed 25 October 2026 · official
  2. Create a Server-to-Server OAuth app Needs role permission for S2S apps and each scope; App credentials show account ID, client ID, secret; developer contact required; app must be activated before tokens work; deactivation stops tokens. · accessed 25 October 2026 · official
  3. App Review Process Public and unlisted apps are reviewed; private and beta apps are not; stages: completeness and branding, functionality/usability/compliance, security review (technical design, scopes, OWASP Top 10 testing), remediation, ongoing monitoring; no fixed timeline. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Zoom is not affiliated with verapli.