# Authenticating server API calls from zoom app sdk

**URL:** <https://devforum.zoom.us/t/authenticating-server-api-calls-from-zoom-app-sdk/126265>\
**Category:** Zoom Apps\
**Created:** [February 8, 2025, 3:02pm UTC](https://devforum.zoom.us/t/authenticating-server-api-calls-from-zoom-app-sdk/126265 "2025-02-08T15:02:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Warren1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/warren1/32/66992_2.png) [@Warren1](https://devforum.zoom.us/u/Warren1)\
**Post date:** [February 8, 2025, 3:02pm UTC](https://devforum.zoom.us/t/authenticating-server-api-calls-from-zoom-app-sdk/126265/1 "2025-02-08T15:02:45Z")

</div>

I’m using the zoom app sdk in a web app. I want my web app to make API calls to my server. I need to cryptographically verify that these calls came from a valid web app session, and not a malicious 3rd party.

I do not want to send the user through an Oauth path. I don’t need permission to do anything on their behalf. I only need to ensure that the traffic is valid.

I found some mentions of getting a session token or a signed context object, but I can’t find any documentation and everything I tried failed. It seems like there should be a way to obtain an object with the meeting ID and user ID that’s signed and can be validated if I know the shared secret that was used to sign it.

This must be a common use case, right? How do I ensure that traffic to my backend API, and the meeting ID and user ID, are valid?

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [February 11, 2025, 6:56pm UTC](https://devforum.zoom.us/t/authenticating-server-api-calls-from-zoom-app-sdk/126265/2 "2025-02-11T18:56:49Z")

</div>

@Warren1 ,

Here is the support documentation on this topic. The tl;dr is Zoom sends an HTTP request to your app’s Home URL and upon successfully completing the request, it renders the content of the Home URL in the Zoom client. Read more about this topic here:

> **[Zoom Apps Context - Zoom Developers](https://developers.zoom.us/docs/zoom-apps/zoom-app-context/#x-zoom-app-context-header)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

---

<div class="post-metadata">

**Author:** ![Warren1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/warren1/32/66992_2.png) [@Warren1](https://devforum.zoom.us/u/Warren1)\
**Post date:** [February 13, 2025, 9:58pm UTC](https://devforum.zoom.us/t/authenticating-server-api-calls-from-zoom-app-sdk/126265/3 "2025-02-13T21:58:10Z")

</div>

Thank you so much, Donte!