# Zoom SDK Web hide API key and Secret

**URL:** <https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931>\
**Category:** Web\
**Created:** [March 27, 2020, 11:41pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931 "2020-03-27T23:41:01Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [March 27, 2020, 11:41pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/1 "2020-03-27T23:41:01Z")

</div>

I have tried using the Zoom SDK [Web sample app](https://github.com/zoom/sample-app-web)

Just wondering how can i hide the API key and Secret. By following the instructions on [this page](https://github.com/zoom/websdk-sample-signature-node.js), created a heroku app and it seems to be working when i make a POST request from postman.

What don’t know is how to get the signature to my front end app make it work with out keeping api secret and key in my index.js file.

I’m using CDN version. Live version hosted on [here](https://zoom.domoretesting.online/)

my index.js file,

```
(function(){

    console.log('checkSystemRequirements');

    console.log(JSON.stringify(ZoomMtg.checkSystemRequirements()));

    // it's option if you want to change the WebSDK dependency link resources. setZoomJSLib must be run at first

    // if (!china) ZoomMtg.setZoomJSLib('https://source.zoom.us/1.7.2/lib', '/av'); // CDN version default

    // else ZoomMtg.setZoomJSLib('https://jssdk.zoomus.cn/1.7.2/lib', '/av'); // china cdn option 

    // ZoomMtg.setZoomJSLib('http://localhost:9999/node_modules/@zoomus/websdk/dist/lib', '/av'); // Local version default, Angular Project change to use cdn version

    ZoomMtg.preLoadWasm();

    ZoomMtg.prepareJssdk();
  
    var API_KEY = 'api_key'; 

    var API_SECRET = 'secret';

    document.getElementById('join_meeting').addEventListener('click', function(e){

        e.preventDefault();

        if(!this.form.checkValidity()){

            alert("Enter Name and Meeting Number");

            return false;

        }

        var meetConfig = {

            apiKey: API_KEY,

            apiSecret: API_SECRET,

            meetingNumber: parseInt(document.getElementById('meeting_number').value),

            userName: document.getElementById('display_name').value,

            passWord: "",

            leaveUrl: "https://zoom.us",

            role: 0

        };

        var signature = ZoomMtg.generateSignature({

            meetingNumber: meetConfig.meetingNumber,

            apiKey: meetConfig.apiKey,

            apiSecret: meetConfig.apiSecret,

            role: meetConfig.role,

            success: function(res){

                console.log(res.result);

            }

        });

        ZoomMtg.init({

            leaveUrl: 'http://www.zoom.us',

            isSupportAV: true,

            success: function () {

                ZoomMtg.join(

                    {

signature: signature,                        

meetingNumber: meetConfig.meetingNumber,

                        userName: meetConfig.userName,

                        signature: signature,

                        apiKey: meetConfig.apiKey,

                        userEmail: 'email@gmail.com',

                        passWord: meetConfig.passWord,

                        success: function(res){

                            $('#nav-tool').hide();

                            console.log('join meeting success');

                        },

                        error: function(res) {

                            console.log(res);

                        }

                    }

                );

            },

            error: function(res) {

                console.log(res);

            }

        });

    });

})();

```

Any help much appreciated. !

Thanks !`Preformatted text`

---

<div class="post-metadata">

**Author:** ![zhang\_meifu](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zhang\_meifu](https://devforum.zoom.us/u/zhang_meifu)\
**Post date:** [March 28, 2020, 12:23pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/2 "2020-03-28T12:23:05Z")

</div>

> [@charitha](#):
>
> API\_SECRET

I have developed this.

1. In the html page, request the background to obtain a signature through the post method.
2. In the background, obtain the signature through JAVA or PHP;
3. Return the signature to the front desk.  
Can refer to:  
[https://marketplace.zoom.us/docs/sdk/native-sdks/web/essential/signature](https://marketplace.zoom.us/docs/sdk/native-sdks/web/essential/signature)

---

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [March 29, 2020, 6:02am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/3 "2020-03-29T06:02:27Z")

</div>

Thank you very much for the suggestion. This is my index.js code now.

```
(function(){
	console.log('checkSystemRequirements');
	console.log(JSON.stringify(ZoomMtg.checkSystemRequirements()));

 ZoomMtg.setZoomJSLib('https://dmogdx0jrul3u.cloudfront.net/1.4.2/lib', '/av');

ZoomMtg.preLoadWasm();

ZoomMtg.prepareJssdk();

var API_KEY = 'xxxxxxxx';  

document.getElementById('join_meeting').addEventListener('click', function(e){
    e.preventDefault();

    if(!this.form.checkValidity()){
        alert("Enter Name and Meeting Number");
        return false;
    }

    var meetConfig = {
        apiKey: API_KEY,
        meetingNumber: parseInt(document.getElementById('meeting_number').value),
        userName: document.getElementById('display_name').value,
        passWord: "",
        leaveUrl: "https://zoom.us",
        role: 0
    };

    var endpoint = 'https://ipaa.herokuapp.com';
    fetch(`${endpoint}`, {
        method: 'POST',
        body: JSON.stringify({ meetingData: meetConfig })
    })
 
.then(result => result.text())
.then(response => {
    console.log(response);
        ZoomMtg.init({
        leaveUrl: 'http://www.zoom.us',
        isSupportAV: true,
        success: function () {
            ZoomMtg.join(
                {
                    signature: response,               
                    meetingNumber: meetConfig.meetingNumber,
                    userName: meetConfig.userName,
                    apiKey: meetConfig.apiKey,
                    //userEmail: 'user@gmail.com',
                    passWord: meetConfig.passWord,
                    success: function(res){
                        $('#nav-tool').hide();
                        console.log('join meeting success');
                    },
                    error: function(res) {
                        console.log(res);
                    }
                }
            );
        },
        error: function(res) {
            console.log(res);
        }
    });

})

});

})();

```

Im getting the following error “Join fail” .

` **{method: "join", status: false, errorCode: 1, errorMessage: "joining fail", result: null}** `

 ![error](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/b/ba1015c7ea621bc55a02f9fca78fb6a2e421e009.png)

In the console i can see im getting a signature from my [endpoint](https://ipaa.herokuapp.com) . But i notice that the length of signature received when i use heroku endpoint and using api key and secret directly on index.js page is different. (I have use the same meeting id to check both methods)

Is the issue here my endpoint not working properly and its wending the incorrect signature or is there any coding issue in my index.js file.

Thank you !

---

<div class="post-metadata">

**Author:** ![zhang\_meifu](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zhang\_meifu](https://devforum.zoom.us/u/zhang_meifu)\
**Post date:** [March 29, 2020, 12:22pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/4 "2020-03-29T12:22:12Z")

</div>

If the signature is generated according to the official method, there should be no problem.  
Can you copy the signature generation method?

---

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [March 29, 2020, 1:09pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/5 "2020-03-29T13:09:15Z")

</div>

Im using [Sample signature app](https://github.com/zoom/websdk-sample-signature-node.js) referenced in the documentation. I have it deployed to heroku and using the app URL as my signature endpoint.

Then i pass my endpoint url as below to my index.js script.([documentation link](https://marketplace.zoom.us/docs/sdk/native-sdks/web/essential/start-join-meeting))

```
var endpoint = 'https://ipaa.herokuapp.com';
    fetch(`${endpoint}`, {
        method: 'POST',
        body: JSON.stringify({ meetingData: meetConfig })
    })
 
.then(result => result.text())
.then(response => {
    console.log(response);
        ZoomMtg.init({
        leaveUrl: 'http://www.zoom.us',
        isSupportAV: true,
        success: function () {
            ZoomMtg.join(
                {
                    signature: response,               
                    meetingNumber: meetConfig.meetingNumber,
                    userName: meetConfig.userName,
                    apiKey: meetConfig.apiKey,
                    //userEmail: 'user@gmail.com',
                    passWord: meetConfig.passWord,
                    success: function(res){
                        $('#nav-tool').hide();
                        console.log('join meeting success');
                    },
                    error: function(res) {
                        console.log(res);
                    }
                }
            );
```

---

<div class="post-metadata">

**Author:** ![zhang\_meifu](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zhang\_meifu](https://devforum.zoom.us/u/zhang_meifu)\
**Post date:** [March 29, 2020, 11:42pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/6 "2020-03-29T23:42:57Z")

</div>

The JSON format returned from my visit to your URL address is shown below, but I don’t see the parsing of this JSON object in your code, and the corresponding fields are used for correct assignment. Please check.  
{  
“signature”: “”  
}

_console.log(response);_  
ZoomMtg.init({  
leaveUrl: ‘[http://www.zoom.us](http://www.zoom.us)’,  
isSupportAV: true,  
success: function () {  
ZoomMtg.join(  
{  
_signature: response,_

---

<div class="post-metadata">

**Author:** ![drunkbiblestudy](https://avatars.discourse-cdn.com/v4/letter/d/b4bc9f/32.png) [@drunkbiblestudy](https://devforum.zoom.us/u/drunkbiblestudy)\
**Post date:** [March 30, 2020, 2:02am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/7 "2020-03-30T02:02:42Z")

</div>

I’m having the same problem as @charitha.  
I can join a meeting successfully when using ZoomMtg.generateSignature() but I am getting an error when trying to use the Heroku app ([/docs/sdk/native-sdks/web/essential/signature](https://marketplace.zoom.us/docs/sdk/native-sdks/web/essential/signature))

I’ve deployed it and entered my API key and secret – the same ones I’m using for the built-in generateSignature() function.

The error I’m getting doesn’t specify anything, unfortunately. It just says:  
errorCode:1  
errorMessage:“joining fail”  
method:“join”  
result:null  
status:false

To check, I am comparing the signatures generated by the card-coded one and the heroku app and they start similarly but are different and also a different length.

At this point my two best guesses are

1. that there is some difference in the way that ‘crypto’ and ‘crypto-js’ do their hashing or
2. that there’s some problem being caused by web string encoding or something like that.

Would love some help!

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [March 30, 2020, 4:48am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/8 "2020-03-30T04:48:22Z")

</div>

Hi @drunkbiblestudy,

We just updated our sample generate signature app for node.js[1]. Can you re-clone the repo and see if generating a signature and joining a meeting works for you now?

1 - [https://github.com/zoom/websdk-sample-signature-node.js](https://github.com/zoom/websdk-sample-signature-node.js)

Thanks

---

<div class="post-metadata">

**Author:** ![drunkbiblestudy](https://avatars.discourse-cdn.com/v4/letter/d/b4bc9f/32.png) [@drunkbiblestudy](https://devforum.zoom.us/u/drunkbiblestudy)\
**Post date:** [March 30, 2020, 7:44am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/9 "2020-03-30T07:44:24Z")

</div>

Thanks @michael_p.zoom,  
I will look into this more tomorrow. I see that you changed the Date().getTime() to include -30000 so it matches the other documentation.  
From my immediate test, though, it seems to have the same problem where the keys returned are different lengths.  
The built-in generateKey returns a 126 character string:  
eg.

---

<div class="post-metadata">

**Author:** ![drunkbiblestudy](https://avatars.discourse-cdn.com/v4/letter/d/b4bc9f/32.png) [@drunkbiblestudy](https://devforum.zoom.us/u/drunkbiblestudy)\
**Post date:** [March 31, 2020, 12:27am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/10 "2020-03-31T00:27:28Z")

</div>

@michael_p.zoom  
I’m still having the same problem.  
Does anyone have an idea why the heroku app would return a different length of string from the built-in ZoomMtg.generateSignature function?

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [March 31, 2020, 7:01am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/11 "2020-03-31T07:01:13Z")

</div>

Hey @drunkbiblestudy,

After [base64 decoding](https://www.base64decode.org/) your signatures, you are passing in `undefined` for the meeting ID and the role.

That is probably the issue.

 ![Screen Shot 2020-03-31 at 12.59.50 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/7/7057d6281814a2091e4b50d6a48da8fce7a38472.png)

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [March 31, 2020, 7:02am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/12 "2020-03-31T07:02:29Z")

</div>

Thanks for your help @zhang_meifu! 🙂

@charitha, please let us know if you were able to resolve the issue.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [March 31, 2020, 9:28am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/13 "2020-03-31T09:28:22Z")

</div>

Hi @tommy and @zhang_meifu

Thanks for pointing us for the right direction.

My first mistake was sending this POST request to the endpoint in text format It should be JSON request. 😇

Secondly, as @zhang_meifu mentioned in his reply, i had few issue with my index.js too. The issue was, reply from my javascript fetch request did not correctly passed to the ZoomMtg.join function. About hour of trial and error, i was able to fix my code finally.

Happy to say its working well now. Below is my index.js file. 🙂

```
(function(){

    console.log('checkSystemRequirements');

    console.log(JSON.stringify(ZoomMtg.checkSystemRequirements()));

 ZoomMtg.setZoomJSLib('https://dmogdx0jrul3u.cloudfront.net/1.4.2/lib', '/av');

ZoomMtg.preLoadWasm();

ZoomMtg.prepareJssdk();

var API_KEY = 'XXXXXXX';  

document.getElementById('join_meeting').addEventListener('click', function(e){

    e.preventDefault();

    if(!this.form.checkValidity()){

        alert("Enter Name and Meeting Number");

        return false;

    }

    var meetConfig = {

        apiKey: API_KEY,

        meetingNumber: parseInt(document.getElementById('meeting_number').value),

        userName: document.getElementById('display_name').value,

        passWord: "",

        leaveUrl: "https://zoom.us",

        role: 0

    };

    var endpoint = 'https://ipaa.herokuapp.com';

   var raw = JSON.stringify({"meetingNumber":meetConfig.meetingNumber,"role":1});

    fetch(`${endpoint}`, {

        method: 'POST',

        headers: {

            'Content-Type': 'application/json',

          },

        body: raw,

    })

.then(result => result.text())

.then(response => {

    console.log(response);

    var signature = JSON.parse(response);

    console.log(signature);

        ZoomMtg.init({

        leaveUrl: 'http://www.zoom.us',

        isSupportAV: true,

        success: function () {

            ZoomMtg.join(

                {

                    signature: signature.signature,               

                    meetingNumber: meetConfig.meetingNumber,

                    userName: meetConfig.userName,

                    apiKey: meetConfig.apiKey,

                    //userEmail: 'user@gmail.com',

                    passWord: meetConfig.passWord,

                    success: function(res){

                        $('#nav-tool').hide();

                        console.log('join meeting success');

                    },

                    error: function(res) {

                        console.log(res);

                    }

                }

            );

        },

        error: function(res) {

            console.log(res);

        }

    });

})

});

})();
```

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [March 31, 2020, 7:36pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/14 "2020-03-31T19:36:19Z")

</div>

Hey @charitha,

Happy to hear it’s working now! 🙂

Let us know if you have additional questions!

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [April 3, 2020, 9:06am UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/15 "2020-04-03T09:06:53Z")

</div>

Hi Tommy

It was working perfectly until now and im getting following error in console.

**Sample web app show the following error** :- Your connection has timed out and you cannot join the meeting. Verify your network connectivity and try again.

Thanks !  
Charitha

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 3, 2020, 8:07pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/16 "2020-04-03T20:07:46Z")

</div>

Hey @charitha,

We are working to get the [Zoom Web Client](https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client) and [Zoom Web SDK](https://marketplace.zoom.us/docs/sdk/native-sdks/web) back online. Please keep up with our status page for detailed updates: [status.zoom.us](http://status.zoom.us/)

> [@Developer impacting changes during COVID-19](https://devforum.zoom.us/t/developer-impacting-changes-during-covid-19/8930):
>
> [Developer impacting changes during COVID-19](https://devforum.zoom.us/t/developer-impacting-changes-during-covid-19/8930)Zoom Developer Documentation Survey Please take a few minutes to fill out the [Zoom Developer Docs survey](https://forms.gle/mHCNSZuWfsNDcyMc8) and let us know how we can assist you better with our docs. Your input will be invaluable in improving our documentation. Delayed responses by Zoom staff on developer forum due to volume of posts. Expect a reply in 24 hours on weekdays. What does this mean? During these tough times, we are seeing a massive increase in demand for our services. To …

* * *

The best workaround is to use the Zoom Desktop / Mobile app.

Just include the Zoom meeting join url (`https://zoom.us/j/meetingID`) on your site rather than showing the websdk / iframe. Clicking on the join url will open the Zoom meeting in the Zoom app.

Apologies for the inconvenience,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 3, 2020, 8:08pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/17 "2020-04-03T20:08:12Z")

</div>

Please see the note from the Manager of Developer Relations at Zoom.

> [@\[Resolved with 1.7.4+\] Web SDK / Web Client from browser: 403 Forbidden](https://devforum.zoom.us/t/webinar-from-browser-403-forbidden/10782/58):
>
> Hello everyone, Let me be the first to say we understand what kind of stress this is adding to your lives. For that, we can only offer our apologies and assurances that we are hard at work bringing up these services. It is a top priority for us. As you can imagine, we don’t want to provide false hope, and at the moment, we just don’t have enough information to share an accurate timeline. Senior leadership and I are closely monitoring this and will update the status page as we know more. I ap…

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![charitha](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@charitha](https://devforum.zoom.us/u/charitha)\
**Post date:** [April 5, 2020, 10:16pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/18 "2020-04-05T22:16:15Z")

</div>

Hi Tommy,

I’m still getting the same error. I have tried putting direct api key and secret according to sample app too. Still getting the same error.  
 ![error1](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/3/31270cfb05a297bec9e046097cf8ee68954e35e3.png)

Thanks !

Charitha

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 6, 2020, 6:02pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/19 "2020-04-06T18:02:53Z")

</div>

Hey @charitha

Please see latest update here for the Web SDK:

[https://marketplace.zoom.us/docs/guides/getting-started/stay-up-to-date/upcoming-changes/web-sdk](https://marketplace.zoom.us/docs/guides/getting-started/stay-up-to-date/upcoming-changes/web-sdk)

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 8:16pm UTC](https://devforum.zoom.us/t/zoom-sdk-web-hide-api-key-and-secret/9931/20 "2020-08-21T20:16:29Z")

</div>

Closed on August 21, 2020, 8:16pm UTC