Published Web Meeting SDK app: role 1 + host ZAK fails only for external-account hosts

[dcalle (Dmytro)]

We have a Marketplace-approved, published app that combines OAuth with the Web Meeting SDK. Starting as host works when the meeting host belongs to the Zoom account that owns the app, but fails consistently when the host is a Pro user in another Zoom account who installed and authorized the same published app.

Controlled comparison

• Same published Meeting SDK app, production release, Mac, and network.
• The meeting is created under the OAuth-authorized user, and /users/me matches the meeting’s host_id.
• We request a fresh host ZAK from /v2/users/me/token?type=zak.
• The server-generated Meeting SDK JWT uses role: 1.
• Zoom REST, ZAK, and signature requests all return 200.
• A host in the app owner’s Zoom account joins successfully.
• A Pro host in a different Zoom account disconnects before ZoomMtg.join() succeeds; meetingStatus transitions from 1 to 3.
• An older SDK exposed 4011 / NOT_ALLOW_CROSS_JOIN for this case. Web Meeting SDK 6.2.0 only exposes the generic status 3.
• Approval and publication of the app did not change the result.

Reproduction

1. A user in an external Zoom account installs and authorizes the published app.
2. The app creates a meeting under that connected user.
3. The backend confirms the connected Zoom user is the meeting host, gets a fresh ZAK, and signs a Meeting SDK JWT with role: 1.
4. The Web Meeting SDK initializes normally, then disconnects before the join succeeds.
5. Repeating the same flow with a host in the app owner’s Zoom account succeeds.

Questions

1. Is a published Meeting SDK app supposed to be able to start a meeting with role: 1 and the host’s ZAK when that host is in a different Zoom account from the app owner?
2. If this is supported, is there an additional entitlement, Marketplace setting, or account relationship required beyond publication and the external host’s OAuth authorization?
3. If it is not supported, where is that restriction documented? The current authorization guidance appears to describe external-host use with a host ZAK, while Zoom staff has said that an SDK app cannot start a meeting for an external user.
4. After the March 2026 OBF change, what is the supported embedded path for this human host? If they start the meeting in Zoom first, should they join the already-running meeting through Web Meeting SDK with role: 0 plus ZAK, role: 0 plus OBF, or is there no supported way for them to retain host controls in the embedded client?

This related report describes the same account-dependent behavior and received the answer that external-user start is not supported:

Meeting start (ZoomMtg.join() with role: 1) silently fails (meetingStatus 1→3, no error) for external/non-developer host accounts

Using Meeting SDK Web 6.1.0. role: 1 + a valid host ZAK reliably starts a meeting when the joining account is the same account that owns the Marketplace app (developer’s own account). The identical code, same app, same signature-generation logic, fails every time when the ZAK belongs to a different (external) Zoom Business-tier account that has authorized the app. Symptom: onMeetingStatus goes 1 → 1 → 3 with no error code and no error ever reaching join()'s own error callback (confirmed via unc…

Relevant Zoom guidance:

Meeting SDK authorization - Meeting SDK - Zoom Developer Docs

Updates to Meeting SDK Authorization FAQ

Beginning March 2, 2026, Zoom requires the use of an On Behalf Of (OBF) token for Meeting SDK (MSDK) apps joining meetings hosted by external accounts. For use cases requiring continuous data access or persistent recording, use Real Time Media Streams (RTMS) for best results. (Originally, we were targeting February 23, but we heard your feedback and moved the enforcement date out.) To retrieve an OBF token using the REST API, implement the OAuth flow with the user:read:token scopes. New authe…

Environment

• Web Meeting SDK 6.2.0
• Chrome on macOS
• Published Marketplace app using OAuth and Meeting SDK credentials

We can provide exact timestamps, meeting and SDK identifiers, sanitized token claims, and browser logs privately to Zoom staff. I am intentionally leaving those identifiers out of this public post.

[chunsiong.zoom (Chun Siong)]

@dcalle Meeting SDK is not allowed to start a meeting for an external user.

[dcalle (Dmytro)]

@chunsiong.zoom can you please elaborate? External user in this case being a Zoom user that belongs to a workspace different than the one the Zoom App was published from?