# Example to Create a SDK meeting URGENT

**URL:** <https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858>\
**Category:** Web\
**Created:** [August 2, 2023, 10:57pm UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858 "2023-08-02T22:57:04Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![aquarivm](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/aquarivm/32/8645_2.png) [@aquarivm](https://devforum.zoom.us/u/aquarivm)\
**Post date:** [August 2, 2023, 10:57pm UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/1 "2023-08-02T22:57:04Z")

</div>

Hello everyone.

Currently the company has an application developed to carry out virtual assemblies in which the zoom interface is embedded in one of its views, we only use the client view, the meetings are parameterized and created directly from the zoom web page , I have spent several days reading a post about the need to create an sdk application to replace the old jwt which is currently being used.

I don’t handle the application code very well and I don’t understand the examples that are posted in the migration examples, I would like to know if it is possible that someone can explain to me with a very clear example the creation of the sdk jwt token, I was able to generate it using jsrsasign javascript however I have seen that the signature of the new version 2.14.0 has a new way of creating the signature which in my little understanding asks to bring the json from a localhost server with port 4000, this is where I get most confused. If I have the signature encrypted with HS256 as shown in the following code, can’t I just replace apikey values ​​with sdkkeys and so on?

var oHeader = {alg: ‘HS256’, typ: ‘JWT’};  
var oPayload = {};  
var tNow = KJUR.jws.IntDate.get(‘now’);  
var tEnd = KJUR.jws.IntDate.get(‘now + 1day’);  
oPayload.sdkKey = “XXXXXXXXXXXXXXXXXXXXXXXXXXX”;  
oPayload.appKey = “XXXXXXXXXXXXXXXXXXXX”;  
oPayload.mn = “8440528XXXX”;  
oPayload.role = 0;  
oPayload.iat = tNow;  
oPayload.exp = tEnd;  
oPayload.tokenExp = tEnd;  
var sHeader = JSON.stringify(oHeader);  
var sPayload = JSON.stringify(oPayload);  
var sJWT = KJUR.jws.JWS.sign(“HS256”, sHeader, sPayload, “XXXXXXXXXXXXXXXXX”);

This gives me a key with the structure of the example found in the post eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZGtLZXkiOiJhYmMxMjMiLCJtbiI6IjEyMzQ1Njc4OSIsInJvbGUiOjAsImlhdCI6MTY0NjkzNzU1MywiZ XhwIjoxNjQ2OTQ0NzUzLCJhcHBLZXkiOiJhYmMxMjMiLCJ0b2tlbkV4cCI6MTY0Njk0NDc1M30.UcWxbWY-y22wFarBBc9i3lGQuZAsuUpl8GRR8wUah2M

However this string is not accepted by the function to generate signature since a localhost server is required, is what I understand.

Can someone help me with these doubts about how to correctly implement an sdk application step by step, I know that you have the necessary documentation but I am an empirical in programming with these languages ​​and more with the use of api and others.

 ![Zoom1](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/2/b2af4074b71329fb87cad88367038bd437682eda.png)

Is there a way to create the signature without so much security? I shouldn’t ask this but it may be an immediate solution for me since we have an event in a couple of days and I understand that version 2.6.0 which is currently running will end on August 5th and the event is on August 6th.

In advance thanks for the help.

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [August 3, 2023, 4:20am UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/2 "2023-08-03T04:20:32Z")

</div>

@aquarivm ,

I understand you are upgrading from web sdk 2.6.x to 2.14.0

- Web SDK 2.14.0 requires JWT token generated using either (ClientID and ClientSecret) or (SDKKey and SDKSecret) pair. Either pair works fine.

- The JWT Token which you have shared looks fine, you just need to enter a valid

- If your Web SDK joins a meeting which is created or resides outside of the Web SDK’s zoom account, you will need to publish your Meeting SDK app. If you do not publish it, you will encounter an error when trying to join meeting outside of your account.

> Is there a way to create the signature without so much security? I shouldn’t ask this but it may be an immediate solution for me since we have an event in a couple of days and I understand that version 2.6.0 which is currently running will end on August 5th and the event is on August 6th.

← yes there is. you can generate your JWT token on the client side(A VERY BAD IDEA). This is equivalent to sharing your SDKKey and SDKSecret with the public, as client side JWT token generation would need SDKKey and SDKSecret in cleartext.

---

<div class="post-metadata">

**Author:** ![aquarivm](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/aquarivm/32/8645_2.png) [@aquarivm](https://devforum.zoom.us/u/aquarivm)\
**Post date:** [August 3, 2023, 1:38pm UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/3 "2023-08-03T13:38:42Z")

</div>

Hello, thank you very much for the prompt response.

I am migrating from a JWT application that we have had for about 2 or 3 years to an sdk, so it is something new for me.

 ![Zoom2](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/3/e/3e4c267d3896184a7e14314f3aed4514a32b15e0.jpeg)

I’ll connect to meetings created in my own account where the sdk keys and such were created, so there should be no problem.

I understand that I should not generate the JWT from the client side and it is considered a very bad development practice, but as I said, I am new to development and due to the urgency of the situation, I feel the need to do so this time. , after the event I will correct it more calmly. To do it this way, what should I do?

I have this code on the client side at the moment and using the jsrsasign library to generate the jwt signature I understand that I must pass this key to the function to generate signature of the client-view.js however how would the new function look since would receive the direct data?

 ![Zoom3](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/f/1/f1719a9ec64767a4971c36b1ed7b3c829b039be4.jpeg)

Regarding the data to generate the signature, what should I put in sdkkey and appkey?

 ![Zoom4](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/0/f/0faab20864d64c8e888ea6c155a1a06712ce81b8.png)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/c/9/c929c57a1ee4ed85ab3ee27b28308addc941df14.png)

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [August 3, 2023, 2:10pm UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/4 "2023-08-03T14:10:21Z")

</div>

@aquarivm

Instead of having the chunk of code on the html page, consider this in your index.js  
`process.env.ZOOM_MEETING_SDK_KEY` is your SDK Key  
`process.env.ZOOM_MEETING_SDK_SECRET` is your SDK Secret  
YOUR\_MEETING\_NUMBER is self explanatory  
YOUR\_ROLE is either 0 or 1. 0 is for participant. 1 is for host.

```auto
function getSignature() {
  // Your client-side data (meetingNumber and role)
  const meetingNumber = YOUR_MEETING_NUMBER;
  const role = YOUR_ROLE;

  const iat = Math.round(new Date().getTime() / 1000) - 30;
  const exp = iat + 60 * 60 * 2;

  const oHeader = { alg: 'HS256', typ: 'JWT' };

  const oPayload = {
    sdkKey: process.env.ZOOM_MEETING_SDK_KEY,
    mn: meetingNumber,
    role: role,
    iat: iat,
    exp: exp,
    appKey: process.env.ZOOM_MEETING_SDK_KEY,
    tokenExp: iat + 60 * 60 * 2,
  };

  const sHeader = JSON.stringify(oHeader);
  const sPayload = JSON.stringify(oPayload);
  const signature = KJUR.jws.JWS.sign('HS256', sHeader, sPayload, process.env.ZOOM_MEETING_SDK_SECRET);

  // The signature is generated locally, so you can call your startMeeting function directly
  startMeeting(signature);
}

```

---

<div class="post-metadata">

**Author:** ![aquarivm](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/aquarivm/32/8645_2.png) [@aquarivm](https://devforum.zoom.us/u/aquarivm)\
**Post date:** [August 24, 2023, 1:57pm UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/5 "2023-08-24T13:57:33Z")

</div>

- If your Web SDK joins a meeting which is created or resides outside of the Web SDK’s zoom account, you will need to publish your Meeting SDK app. If you do not publish it, you will encounter an error when trying to join meeting outside of your account.

Hello, do you mean that I have to enable the following option in my SDK in the Marketplace?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/4/f/4f4c699d6e90ed5431b7dd3323eb59e22375079a.png)

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [August 25, 2023, 1:51am UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/6 "2023-08-25T01:51:32Z")

</div>

@aquarivm ,

The “change now” button is the first step.  
You will also need to fill up additional details before you can submit this for evaluation / review.

The reviewer will then work with you with additional queries before it is approved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [September 24, 2023, 11:52am UTC](https://devforum.zoom.us/t/example-to-create-a-sdk-meeting-urgent/92858/7 "2023-09-24T11:52:03Z")

</div>

Closed on September 24, 2023, 11:52am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.