--- title: Zoom Gets the Headless Half of Programmatic Onboarding Right description: Server-to-Server OAuth in Zoom's API is examined as a case study in programmatic onboarding for AI agents. Creating the app itself still requires manual... canonical: https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zoom Gets the Headless Half of Programmatic Onboarding Right | daily.dev og:description: Server-to-Server OAuth in Zoom's API is examined as a case study in programmatic onboarding for AI agents. Creating the app itself still requires manual... og:url: https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f og:image: https://api.daily.dev/og/posts/zuwu9SO5F.png og:image:alt: Zoom Gets the Headless Half of Programmatic Onboarding Right og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zoom Gets the Headless Half of Programmatic Onboarding Right **[API Evangelist](https://daily.dev/sources/apievangelist)** · 8 min read · 1 upvotes · 0 comments ## Summary Server-to-Server OAuth in Zoom's API is examined as a case study in programmatic onboarding for AI agents. Creating the app itself still requires manual clicking through the Zoom App Marketplace dashboard to get an account ID, client ID, and client secret, but once those three values exist, the rest is fully headless: a POST to the token endpoint with HTTP Basic auth returns a one-hour access token with no refresh token needed, and a call to /v2/users/me confirms the identity. A companion Node.js script (stdlib only) automates this token-minting and verification flow, reading credentials from environment variables. The piece argues Zoom should add an API to register S2S OAuth apps so agents could provision their own credentials without any human touching a dashboard. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I authenticate to the Zoom API without a browser login for an AI agent or script? Use Zoom's Server-to-Server OAuth grant. After creating a Server-to-Server OAuth app once in the Zoom App Marketplace dashboard to get an account_id, client_id, and client_secret, POST to https://zoom.us/oauth/token with grant_type=account_credentials and account_id in the query string, and the client credentials in an HTTP Basic auth header, no browser or user interaction needed afterward. _daily.dev surfaces practical write-ups like this for developers wiring agents into third-party APIs._ ### Does Zoom's Server-to-Server OAuth token include a refresh token? No, Zoom's Server-to-Server OAuth access tokens do not include a refresh token. The token is valid for one hour (expires_in: 3600), and instead of refreshing it, you simply request a new access token from the token endpoint using the same account credentials once the old one expires. _Teams building unattended integrations track auth quirks like this via daily.dev before they hit production._ ### How do I verify a Zoom OAuth access token is working correctly? Call GET https://api.zoom.us/v2/users/me with the access token as a Bearer token in the Authorization header. Zoom returns an api_url in the token response that should be used as the base URL for this call when available, falling back to api.zoom.us; a successful response confirms the token and returns the authenticated user's identity fields like email and account_id. _daily.dev helps developers debugging API auth flows find concrete examples like this one._ ## Similar posts on daily.dev - [What Programmatic Onboarding Looks Like When Discord Won't Let You Register an App](https://daily.dev/posts/what-programmatic-onboarding-looks-like-when-discord-won-t-let-you-register-an-app-25e1jh5cb) · API Evangelist · 0 upvotes · 0 comments - [HubSpot Has the OAuth, but Not the Onboarding](https://daily.dev/posts/hubspot-has-the-oauth-but-not-the-onboarding-okwqcfgri) · API Evangelist · 0 upvotes · 0 comments - [Okta Has the Endpoint for Programmatic Onboarding, It Just Hides the Door](https://daily.dev/posts/okta-has-the-endpoint-for-programmatic-onboarding-it-just-hides-the-door-dbdhuelal) · API Evangelist · 1 upvotes · 0 comments - [SoundCloud Shows What Programmatic API Onboarding Should Look Like](https://daily.dev/posts/soundcloud-shows-what-programmatic-api-onboarding-should-look-like-4olxm7fmz) · API Evangelist · 0 upvotes · 0 comments - [Zuplo Has the Onboarding API, It Just Points It at the Wrong Door](https://daily.dev/posts/zuplo-has-the-onboarding-api-it-just-points-it-at-the-wrong-door-3cgc9l3ol) · API Evangelist · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#nodejs](https://daily.dev/tags/nodejs), [#zoom](https://daily.dev/tags/zoom), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zoom Gets the Headless Half of Programmatic Onboarding Right","url":"https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f"},"datePublished":"2026-08-31T00:51:18.385Z","dateModified":"2026-08-31T00:51:42.734Z","description":"Server-to-Server OAuth in Zoom's API is examined as a case study in programmatic onboarding for AI agents. Creating the app itself still requires manual...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2158b1d9c4eb74e30f46db44acdcddb9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2158b1d9c4eb74e30f46db44acdcddb9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,nodejs,zoom,oauth","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"Zoom Gets the Headless Half of Programmatic Onboarding Right"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zoom-gets-the-headless-half-of-programmatic-onboarding-right-zuwu9so5f#faq","mainEntity":[{"@type":"Question","name":"How do I authenticate to the Zoom API without a browser login for an AI agent or script?","acceptedAnswer":{"@type":"Answer","text":"Use Zoom's Server-to-Server OAuth grant. After creating a Server-to-Server OAuth app once in the Zoom App Marketplace dashboard to get an account_id, client_id, and client_secret, POST to https://zoom.us/oauth/token with grant_type=account_credentials and account_id in the query string, and the client credentials in an HTTP Basic auth header, no browser or user interaction needed afterward. daily.dev surfaces practical write-ups like this for developers wiring agents into third-party APIs."}},{"@type":"Question","name":"Does Zoom's Server-to-Server OAuth token include a refresh token?","acceptedAnswer":{"@type":"Answer","text":"No, Zoom's Server-to-Server OAuth access tokens do not include a refresh token. The token is valid for one hour (expires_in: 3600), and instead of refreshing it, you simply request a new access token from the token endpoint using the same account credentials once the old one expires. Teams building unattended integrations track auth quirks like this via daily.dev before they hit production."}},{"@type":"Question","name":"How do I verify a Zoom OAuth access token is working correctly?","acceptedAnswer":{"@type":"Answer","text":"Call GET https://api.zoom.us/v2/users/me with the access token as a Bearer token in the Authorization header. Zoom returns an api_url in the token response that should be used as the base URL for this call when available, falling back to api.zoom.us; a successful response confirms the token and returns the authenticated user's identity fields like email and account_id. daily.dev helps developers debugging API auth flows find concrete examples like this one."}}]} ```