# Server-to-Server API Integration with Service Account?

**URL:** <https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992>\
**Category:** API and Webhooks\
**Created:** [September 24, 2024, 7:40am UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992 "2024-09-24T07:40:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![busload787](https://avatars.discourse-cdn.com/v4/letter/b/9dc877/32.png) [@busload787](https://devforum.zoom.us/u/busload787)\
**Post date:** [September 24, 2024, 7:40am UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/1 "2024-09-24T07:40:00Z")

</div>

We’re developing automated scripts for recording management using Zoom’s Server-to-Server API integration. However, we’ve encountered a concern:

Currently, API credentials generated from the Marketplace associate all API actions with the creator’s personal account. For instance, when downloading a recording via API, it’s logged as a download by that individual user.

While we appreciate the need for action tracking, we’d prefer these operations to be associated with a dedicated service account for our application, rather than the API creator’s account.

Is it possible to generate Server-to-Server API credentials linked to a service account? If so, could you please provide guidance on how to implement this?

We look forward to your insights on this matter.

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [September 24, 2024, 3:43pm UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/2 "2024-09-24T15:43:54Z")

</div>

Transfer the ownership of the Server-to-Server application to the service user that you want to use. You can do this from the [Created Apps](https://marketplace.zoom.us/user/build) page by finding the table row for your application, selecting the ellipsis, then pick **Transfer App Owner**.

Server-to-Server applications impersonate the owner user. That’s why the owner user needs to have the same permissions as the application’s scopes.

---

<div class="post-metadata">

**Author:** ![busload787](https://avatars.discourse-cdn.com/v4/letter/b/9dc877/32.png) [@busload787](https://devforum.zoom.us/u/busload787)\
**Post date:** [September 25, 2024, 7:44am UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/3 "2024-09-25T07:44:15Z")

</div>

Thanks, that’s a good idea. However, I don’t agree with the sentence “That’s why the owner user needs to have the same permissions as the application’s scopes.”.

As per my experience with S2S applications, the owner just needs the permission to add-edit the integration, and the permissions need to be set in the scopes page. In fact, if a full Zoom account admin is an owner of an app with wrong permissions that app gets this error from a not allowed API:

```auto
"message": "Invalid access token, does not contain scopes:[...]."
```

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [September 25, 2024, 1:22pm UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/4 "2024-09-25T13:22:14Z")

</div>

You need both user permissions and the application scopes. We used to have a least-privilege setup where the application owner had no permissions, and we’d temporarily transfer ownership of the application to a privileged user that would grant the desired scopes, then transfer ownership back to the no-permissions user. Zoom put a stop to that where the no-longer-eligible scopes now get dropped when ownership is transferred.

---

<div class="post-metadata">

**Author:** ![robertroot679](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/robertroot679/32/50924_2.png) [@robertroot679](https://devforum.zoom.us/u/robertroot679)\
**Post date:** [September 27, 2024, 5:51am UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/5 "2024-09-27T05:51:39Z")

</div>

Looking for the same. Any Suggestions?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [September 30, 2025, 9:27pm UTC](https://devforum.zoom.us/t/server-to-server-api-integration-with-service-account/117992/6 "2025-09-30T21:27:54Z")

</div>

Closed on September 30, 2025, 9:27pm UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.
