onAuthorized event not firing on custom domain - works on ngrok

API and Webhooks Authentication
1

Issue

The onAuthorized event from the Zoom Apps SDK is not firing after a user clicks “Allow” on the consent dialog when my app is hosted on a custom domain. The same code works correctly on ngrok.

Environment

  • SDK Version: @zoom/appssdk 0.16.36
  • Zoom Client: 6.6.11.70003 (Mac)
  • Domain: Custom domain on Azure Static Web Apps
  • In-Client OAuth: Enabled

Steps to Reproduce

  1. Open Zoom meeting as host
  2. Launch app from Apps panel
  3. Consent dialog appears
  4. Click “Allow”
  5. zoomSdk.authorize() returns {"message":"Success"}
  6. Expected: onAuthorized event fires
  7. Actual: Event never fires, times out after 60 seconds

Key Finding

Test Result
ngrok domain :white_check_mark: Works
Custom domain :cross_mark: Fails
ngrok app with Home URL set to custom domain :cross_mark: Fails

This proves the issue is domain-specific.

Diagnostic

Added window.addEventListener('message', ...) to capture all postMessages.
Result: No postMessage is received from Zoom when clicking “Allow”.

Configuration Verified

  • Home URL matches OAuth Allow List
  • Domain Allow List includes my domain
  • In-Client OAuth enabled
  • authorize and onAuthorized in SDK capabilities

Has anyone else experienced this? Is there additional domain validation beyond the OAuth Allow List?