# Alternatives to using the \`host\_key\` **URL:** \ **Category:** Host Key removal\ **Created:** [August 17, 2022, 6:06pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422 "2022-08-17T18:06:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 17, 2022, 6:06pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/1 "2022-08-17T18:06:15Z")
With the latest update to the Zoom API, developers will no longer be able to access a user’s `host_key` value. We understand that this is a breaking change and may alter the workflow of some applications. Below are two possible modifications you can make instead of using the `host_key` value. If your use case isn’t mentioned, contact customer support and we will assist you in finding a path forward. ## Use-Case 1: Enterprise customers that want to integrate Zoom user profiles with their IDP/ActiveDirectory/SSO solution For this use case, the developer must create a new structure in their datastore that can be used to map the Zoom `user_id` to the `host_key` value. Any customer’s workflows/automations that are used to get the `host_key` value from Zoom REST APIs, would instead look up this value in the datastore. Before beginning, there are some account settings that need to be altered: 1. Create an Account-Level app, add `user:write:admin` 2. Configure Account Settings so `host_key` is only modifiable by Admin With these settings in place, now the developer’s account-level app can make an [API request to set the host\_key for a given user](https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#tag/Users/operation/user). This value should be saved to the datastore for sharing with end-users. When should a User’s `host_key` be set? - New User Created on Zoom Account - SSO User changed/removed (conditional) on IDP-side - User Removed from Zoom Account - User Transferred/Disassociated from Zoom Account ## Use-case 2: Scheduling meetings for someone else who will be the host (aka assistant schedules meetings for the CEO) This was the most common use case that we saw where the `host_key` value was being used. This modification would involve using the [“schedule\_for” property in the create\_meeting endpoint](https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#tag/Meetings/operation/meetingCreate). To make this possible you would need to change your account settings to [support Schedule-On-Behalf permissions](https://support.zoom.us/hc/en-us/articles/201362803-Scheduling-privilege). ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 17, 2022, 6:06pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/2 "2022-08-17T18:06:39Z")
---
**Author:** ![vaidy1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vaidy1/32/38610_2.png) [@vaidy1](https://devforum.zoom.us/u/vaidy1)\ **Post date:** [August 24, 2022, 10:55pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/3 "2022-08-24T22:55:55Z")
@shariq.torres when will this update be deployed live? We’re currently relying on the host\_key for some key features in our app. And we need some time to migrate our users to a workaround that we’re working on. Hence the question. ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 25, 2022, 5:18pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/4 "2022-08-25T17:18:21Z")
This change should be live right now. ---
**Author:** ![roelanc](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/roelanc/32/40819_2.png) [@roelanc](https://devforum.zoom.us/u/roelanc)\ **Post date:** [August 26, 2022, 12:00am UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/6 "2022-08-26T00:00:40Z")
Hi @shariq.torres , We use Cisco codecs and dial them into a zoom meeting via a sip address. we would create a sip address with the following components [meetingid.passcode.command.hostkey@zoomcrc.com](mailto:meetingid.passcode.command.hostkey@zoomcrc.com) Our script would create the meeting and passcode and get the host key based on the users email. Now I’m stuck manually looking up each request and manually populate the host key. This week alone we’ve done 120ish request. So what would you recommend to help populate the host key. The reason why we included because our zoom meetings are set to disable join before host and for these meetings the host is going to be in the same room as the codec… Not joining the meeting from their own device. Thoughts? Thanks, -Lance ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 26, 2022, 6:01pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/8 "2022-08-26T18:01:18Z")
Lance, I believe that the first alternative approach would work for you. With this approach, the host key is set by your system. This way when you run your script, you can just call your own database with the custom host key that you have provided. ---
**Author:** ![roelanc](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/roelanc/32/40819_2.png) [@roelanc](https://devforum.zoom.us/u/roelanc)\ **Post date:** [August 26, 2022, 6:18pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/9 "2022-08-26T18:18:23Z")
Thanks for the response and for helping put two and two together. I’ll give that some more thought on a host key database and how that could work with our current system. Thanks, -Lance ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 26, 2022, 7:58pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/10 "2022-08-26T19:58:54Z")
No problem. I’m glad I could be service! ---
**Author:** ![sotelemed](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@sotelemed](https://devforum.zoom.us/u/sotelemed)\ **Post date:** [August 27, 2022, 8:55pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/11 "2022-08-27T20:55:21Z")
I am trying to use jwt token to get/set account settings. When i use option=security it fails. If i specify no option the GET works. Whats going on? This has really put a strain on our work flow Also, why were we not notified of this change prior to it going live? ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 29, 2022, 3:15pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/12 "2022-08-29T15:15:23Z")
I’m sorry about the confusion, Tim. We did send out an email communication to the account owners telling them about this change. This change was put in place due to a security concern that we were trying to close ASAP. Now as to your problem with the JWT token, are you trying to use this API to set the host\_key value? ---
**Author:** ![virtualclassroom.nam](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@virtualclassroom.nam](https://devforum.zoom.us/u/virtualclassroom.nam)\ **Post date:** [August 29, 2022, 8:57pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/13 "2022-08-29T20:57:03Z")
Hi Shariq, Are you able to share the link to the article/ communication sent out about this change to remove the accessibility of the host\_key from the Zoom API? thanks, Madalyn ---
**Author:** ![nathaniel.kanner](https://avatars.discourse-cdn.com/v4/letter/n/b782af/32.png) [@nathaniel.kanner](https://devforum.zoom.us/u/nathaniel.kanner)\ **Post date:** [August 30, 2022, 1:59pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/14 "2022-08-30T13:59:02Z")
In light of this change, is there an alternative method to GET an existing “host\_key” value or only to SET it, per use-case 1 above? Please advise. ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 30, 2022, 10:15pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/15 "2022-08-30T22:15:16Z")
We sent an email to all of the Account Owners about the change and we also mentioned it in the August email about the latest releases/changes. ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 30, 2022, 10:19pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/16 "2022-08-30T22:19:54Z")
There is no alternative method to GET an existing host\_key. That piece of info has been turned off. You can set the host\_key yourself using method 1 or configure an account to be able to schedule meetings for others using method 2. ---
**Author:** ![nathaniel.kanner](https://avatars.discourse-cdn.com/v4/letter/n/b782af/32.png) [@nathaniel.kanner](https://devforum.zoom.us/u/nathaniel.kanner)\ **Post date:** [August 31, 2022, 4:12pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/17 "2022-08-31T16:12:53Z")
FYI, our development team uses the Zoom get user settings API method (GET /users/{userId}/settings) to retrieve a user’s “host\_key” value which is made available on our internal portal. Users access a personalized portal page to view their own “host key” value, which is required to start a personal audio conference along with claiming host controls for video meetings. ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [August 31, 2022, 7:21pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/18 "2022-08-31T19:21:12Z")
In your use case, you can set the user’s host\_key to whatever value you see fit and save that to your database when the end-user creates a profile You would then have to send the host\_key value over to Zoom so that we match it with our user records. From then on, you could display the host\_key on the personalized portal page by querying your database. I think that option 1 suits your use-case. ---
**Author:** ![nathaniel.kanner](https://avatars.discourse-cdn.com/v4/letter/n/b782af/32.png) [@nathaniel.kanner](https://devforum.zoom.us/u/nathaniel.kanner)\ **Post date:** [September 1, 2022, 9:38pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/19 "2022-09-01T21:38:11Z")
Our user profiles are already created, so would we have to re-create them to set the user\_key value? ---
**Author:** ![shariq.torres](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/shariq.torres/32/39899_2.png) [@shariq.torres](https://devforum.zoom.us/u/shariq.torres)\ **Post date:** [September 6, 2022, 6:28pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/20 "2022-09-06T18:28:02Z")
You would have to run a backfill script to fill in the host\_key for your existing users. But ultimately, you would be in control of the host\_key value, so you could use whatever scheme you deem fit. ---
**Author:** ![sjdlc](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@sjdlc](https://devforum.zoom.us/u/sjdlc)\ **Post date:** [September 22, 2022, 2:47pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/21 "2022-09-22T14:47:44Z")
Is there a way to prevent the email confirmation from being sent to individuals if we update host keys en-masse? It would be preferable if we could manage comms internally and not scare our users when we regenerate their host key. ---
**Author:** ![sjdlc](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@sjdlc](https://devforum.zoom.us/u/sjdlc)\ **Post date:** [October 12, 2022, 12:30pm UTC](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422/22 "2022-10-12T12:30:42Z")
@shariq.torres any ideas on this? [Next page](https://devforum.zoom.us/t/alternatives-to-using-the-host-key/74422.md?page=2)