Build Zoom Video SDK App

Video SDK - Authorization

Generate JWT signatures for Video SDK authentication.

Overview

Video SDK uses JWT (JSON Web Token) signatures to authenticate users joining video sessions. Signatures must be generated server-side to protect your SDK Secret.

Important: Unlike Zoom Meetings, Video SDK sessions are NOT pre-created. The tpc (topic) in your JWT can be any string you choose - the session is created when the first participant joins with that topic.

Prerequisites

• Video SDK Key and Secret from Marketplace (sign-in required)

• Server-side code to generate signatures

JWT Structure

Note on tpc (Topic):

• Can be any string (e.g., "room-123", "consultation-abc", "game-lobby-5")

• All users joining with the same tpc value join the same session

• Session is created automatically when first user joins

• No API call needed to create the session beforehand

Host and Co-Host via roleType

In Video SDK, host/co-host status is determined entirely by role_type in the JWT — not by runtime API calls.

• Only host or co-host can call client.leave(true) to end session for all

• A participant calling leave(true) only leaves themselves

• No need for makeHost() or makeManager() API calls — use JWT roleType instead

Session Creation Pattern (Bot as Host)

For scenarios where you need a bot to create and manage the session:

1. Bot joins with role_type: 1 → becomes host (creates session)

2. User A joins with role_type: 1 → becomes co-host

3. Bot leaves → User A remains as co-host, can end session

4. User B joins with role_type: 0 → participant

This pattern avoids race conditions from runtime host assignment.

// JWT generation examples
generateJWT(key, secret, sessionName, 1, 'SessionBot');    // Bot: host
generateJWT(key, secret, sessionName, 1, 'Advisor');       // Advisor: co-host
generateJWT(key, secret, sessionName, 0, 'Customer');      // Customer: participant

Signature Generation Best Practices

Short-Lived Tokens (Recommended)

For security, generate tokens with short expiry:

const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours in the past
const exp = Math.floor(Date.now() / 1000) + 10;   // 10 seconds from now

const payload = {
  app_key: SDK_KEY,
  tpc: topic,
  role_type: role,
  user_identity: userIdentity,
  iat: iat,
  exp: exp
};

Why this works:

• exp is only 10 seconds after generation (short-lived for security)

• iat is set 2 hours in the past to satisfy Zoom's requirement that exp - iat >= 2 hours

• Token is generated just before joining, so 10 second window is sufficient

Server-Side Example (Node.js)

const jwt = require('jsonwebtoken');

function generateSignature(sdkKey, sdkSecret, topic, role, userIdentity) {
  const iat = Math.floor(Date.now() / 1000) - 7200; // 2 hours ago
  const exp = Math.floor(Date.now() / 1000) + 10;   // 10 seconds from now

  const payload = {
    app_key: sdkKey,
    tpc: topic,
    role_type: role,
    user_identity: userIdentity || '',
    iat: iat,
    exp: exp
  };

  return jwt.sign(payload, sdkSecret, { algorithm: 'HS256' });
}

Security Guidelines

Resources

• Auth docs: https://developers.zoom.us/docs/video-sdk/auth/