New App - Which Type to use - OAuth or JWT

I am developing a private application for a company that wants its users to set meeting via zoom with their clients.

Communication with zoom will be from a central server where each user has provided information on their own personal zoom account.

My server will acquire the date/time of the meeting and then perform the required API calls to create a meeting in a specific user’s account.

I thought OAuth was the correct choice until I read that zoom would have to contact the user to grant permission to access their account which is currently outside the scope of the project (note: User provides zoom login and password information to my server for use in setting meetings.)

The only thing I need to accomplish is simply creating a meeting for a specific date/time.

Which should I use - OAuth or JWT?

Thanks

Hey @jhinkle,

I would suggest using a JWT App, which are meant to generate JWT Tokens on the server side to make authenticated requests to our API.

"Authorization": "Bearer JWT_TOKEN_HERE"

Thanks,
Tommy

Thanks Tommy. Do I need to create a JWT for each of the independent zoom accounts I will be setting meetings for or can I use just one?

Hi @jhinkle you will create one JWT app which has privilege to authorize requests on behalf of all users on the account.

With the presumption that these users are all on the same company account, the single API Key / Secret pair is used to generate tokens for all users.

No - that is why I asked the original question.

Each user has their own account, independent of each other.

I think I need OAuth but I see big hassles in that direction.

Each independent user is giving me their access information(user name, password, etc) - All I want to do is to set meeting for them.

What is the best approach?

Each independent user is giving me their access information(user name, password, etc) - All I want to do is to set meeting for them.

What is the best approach?

@jhinkle you will need to use OAuth. Your app will request specific scopes for data, then a user will need to authorize & install that app. You are required to receive direct authorization from any user you are creating meetings on behalf of. The sharing of JWT API Keys & Secrets is outside the Marketplace Terms of Service.

Let me ask my question a different way. Since the user is providing me all their information, How would a user set their own meeting using OAuth - why would a user have to authorize them self?

When you say they have to install that app – there is no app for them to install.

Hey @jhinkle,

Instead of the user providing you their username and password, they will sign in with Zoom to your OAuth app, granting you access to make API requests on their behalf.

Does that makes sense?

Thanks,
Tommy

Tommy - Thanks. Makes sense.

1 Like

You are welcome! :slight_smile:

Thanks,
Tommy