# Zoom Create Meeting - suspected Bug

**URL:** <https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584>\
**Category:** API and Webhooks\
**Created:** [August 9, 2018, 9:22pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584 "2018-08-09T21:22:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mithun\_Harikumar\_Nai](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Mithun\_Harikumar\_Nai](https://devforum.zoom.us/u/Mithun_Harikumar_Nai)\
**Post date:** [August 9, 2018, 9:22pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584/1 "2018-08-09T21:22:41Z")

</div>

I’m calling the&nbsp;

[https://api.zoom.us/v2/users/userA%40domain.com/meetings](https://api.zoom.us/v2/users/userA%40domain.com/meetings)

{

“type”: 2,  
“settings”: {  
“host\_video”: true,  
“join\_before\_host”: true,  
“participant\_video”: true

}  
}

to create a meeting and I get the start\_url and join\_url as response.&nbsp;  
When the start\_url is shared with another person userB, and the userB clicks on the link. userB joins the meeting as host, but is shown as userA.&nbsp;

I think this might be a bug, please let me know.

---

<div class="post-metadata">

**Author:** ![Nick\_Grandy](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@Nick\_Grandy](https://devforum.zoom.us/u/Nick_Grandy)\
**Post date:** [August 9, 2018, 9:35pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584/2 "2018-08-09T21:35:42Z")

</div>

Hi Mithun,

Who are you defining as the host of the meeting?&nbsp; To me this sounds like expected behavior.&nbsp; If you define a meeting with userA as the host, then the start\_url will authenticate&nbsp;someone into the meeting as userA.&nbsp; &nbsp;At least, that’s how we are using the API.

---

<div class="post-metadata">

**Author:** ![Mithun\_Harikumar\_Nai](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Mithun\_Harikumar\_Nai](https://devforum.zoom.us/u/Mithun_Harikumar_Nai)\
**Post date:** [August 9, 2018, 9:42pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584/3 "2018-08-09T21:42:27Z")

</div>

Hmm…Interesting.  
So if the meeting is created using UserA through api, and the start\_url is used by someone else, still he/she will be shown as userA.&nbsp;  
One more thing, once the person has got UserA’s start\_url, goes to browser, copy paste the url and starts the meeting, he/she can open a new tab and login to UserA’s account

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [August 9, 2018, 9:47pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584/4 "2018-08-09T21:47:14Z")

</div>

Hi Mithun,&nbsp;

It’s not a bug, it’s by design. The start\_url should never be shared with anyone except the host as it contains the host token information this being able to become the host and login using their account. You should only share the join\_url.&nbsp;

Thanks

---

<div class="post-metadata">

**Author:** ![Mithun\_Harikumar\_Nai](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Mithun\_Harikumar\_Nai](https://devforum.zoom.us/u/Mithun_Harikumar_Nai)\
**Post date:** [August 9, 2018, 9:49pm UTC](https://devforum.zoom.us/t/zoom-create-meeting-suspected-bug/1584/5 "2018-08-09T21:49:02Z")

</div>

Oh…I get it now.&nbsp;

Thanks a lot