# API Disclosure impact

**URL:** <https://devforum.zoom.us/t/api-disclosure-impact/130107>\
**Category:** API and Webhooks\
**Created:** [March 18, 2025, 11:03pm UTC](https://devforum.zoom.us/t/api-disclosure-impact/130107 "2025-03-18T23:03:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rona](https://avatars.discourse-cdn.com/v4/letter/r/73ab20/32.png) [@Rona](https://devforum.zoom.us/u/Rona)\
**Post date:** [March 18, 2025, 11:03pm UTC](https://devforum.zoom.us/t/api-disclosure-impact/130107/1 "2025-03-18T23:03:32Z")

</div>

xxxzzxweretiohgnwoetgipo23qtmq23

---

<div class="post-metadata">

**Author:** ![alexm](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/alexm/32/67701_2.png) [@alexm](https://devforum.zoom.us/u/alexm)\
**Post date:** [March 19, 2025, 12:45am UTC](https://devforum.zoom.us/t/api-disclosure-impact/130107/2 "2025-03-19T00:45:18Z")

</div>

I’d be most concerned if your account ID, API key and API secret were exposed. Hopefully the app you have created associated with the API key in question has very limited scopes. With JUST the key exposed, there probably isn’t a _lot_ of danger. That said, ASAP you ought to rotate it out anyway, after fixing the code that was exposing the key.

In the future, your development team should utilize environment variables that are populated from a secured (and rotatable) key store.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [March 20, 2025, 9:54pm UTC](https://devforum.zoom.us/t/api-disclosure-impact/130107/3 "2025-03-20T21:54:46Z")

</div>

Closed on March 20, 2025, 9:54pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.