Non-interactive authorization

The OAuth 2.0 non-interactive authorization flow enables applications to retrieve access tokens for multiple users without requiring each user to authorize the application individually. Account admins can authorize the application for users or groups in advance, reducing adoption friction and simplifying deployment.

Each user receives a set of access and refresh tokens, which limits the app to accessing only resources that the user is authorized to access.

Token request and exchange overview#

This is an overview of the token request and exchange flow.

1. An administrator initiates the authorization request by adding a non-interactive-authorization-enabled app for users or groups.
2. Zoom sends the bulk authorization code to the OAuth Redirect URL specified in your app configuration.
3. Your redirect page receives the bulk authorization code and sends a request to Zoom to exchange it for a bulk access token.
4. Your redirect page uses the bulk access token to retrieve user OAuth tokens in batches. Zoom generates user-specific access tokens for each authorized user, which they can then use to access Zoom resources.

Implementation#

Developers configure and complete the following steps to make an OAuth 2.0 non-interactive-authorization-enabled app available on the Zoom Marketplace and handle token requests and exchanges on their redirect page.

Step 1: Enable non-interactive batch token retrieval#

Contact Zoom support via the Zoom Developer Forum  to request they enable the non-interactive batch token retrieval feature for your app. In the future, you will be able to enable this yourself, and we will update this document accordingly.

Step 2: Create and configure your app#

Sign in to the Zoom Marketplace and create a user-managed general app. For more information, see the Quick Start Guide.

Step 3: Obtain the bulk authorization code#

Once an administrator initiates the authorization request by adding a non-interactive-authorization-enabled app for users or groups, Zoom sends the bulk authorization code to the OAuth Redirect URL specified in your app configuration.

Set up your redirect page to handle the bulk authorization code. Zoom sends:

• An authorization code (code parameter).
• A code type identifier (code_type=bulk).

Example redirect URL sent by Zoom:

https://app.example.com/oauth/callback?code=BULK_CODE&code_type=bulk

Step 4: Exchange authorization code for bulk access token#

Once your redirect page receives the authorization code, exchange it for a bulk access token by making a POST request to https://zoom.us/oauth/token with the bulk authorization-code grant.

Example request:

curl -X POST "[https://zoom.us/oauth/token](https://zoom.us/oauth/token)" \
  -H "Authorization: Basic $(echo -n 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' | base64)" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=bulk_authorization_code" \
  -d "code=BULK_CODE" \
  -d "redirect_uri=https://your-app.example.com/oauth/callback"

Because the authorization code was issued through the non-interactive bulk flow, the token endpoint returns a bulk access token instead of a standard single-user token. Use the bulk access token as the subject_token in the retrieval requests.

Example response:

{
    "access_token": "bt_xxx",
    "token_type": "bulk_access_token",
    "expires_in": 3600
}

Step 5: Generate user-specific access tokens#

Send a token-exchange request containing your bulk access token.

Make a POST request to https://zoom.us/oauth/token. Include a Basic Authorization header, and pass the following parameters in the request body as application/x-www-form-urlencoded.

Required Parameters#

Example request:

curl -X POST "[https://zoom.us/oauth/token](https://zoom.us/oauth/token)" \
  -H "Authorization: Basic $(echo -n 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' | base64)" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d "subject_token=YOUR_BULK_ACCESS_TOKEN" \
  -d "subject_token_type=urn:ietf:params:oauth:token-type:bulk_access_token" \
  -d "page_size=100"

Response fields:#

Example response:

{
    "api_url": "[https://api.example.com](https://api.example.com)",
    "items": [
        {
            "token_type": "bearer",
            "access_token": "user_access_token_xxx",
            "refresh_token": "user_refresh_token_xxx",
            "id_token": "oidc_user_id_token_xxx",
            "scope": "scope1 scope2",
            "expires_in": 3600,
            "email": "user@example.com"
        }
    ],
    "has_more": true
}

Because user-token preparation may be asynchronous, repeat the request with the same bulk access token when the response indicates that more results are available (has_more: true).

The service retrieves all users covered by your user, group, and account grants, removes duplicates, and caches the list for the session. The response contains the first page of results, with up to 100 user access tokens. If more than 100 users are covered, send additional token-exchange requests with the same bulk access token to get the remaining pages.

Each page is a JSON object with an items array. Each item represents one user and includes that user's access_token and refresh_token.

Subsequent page requests#

If has_more is true, call the same endpoint again with the same bulk access token and the same page_size. Continue until has_more is false.

Testing#

To test the end-to-end authorization flow for your app in your development environment, you must be able to perform admin tasks such as adding the app and assigning it to multiple users. This requires Marketplace admin access.

1. To assign yourself Marketplace admin access, sign in to your account at zoom.us, go to User Management, and assign your role View and Edit admin permissions for Marketplace. For more information, see User Role Management .

2. To access your app's listing page and users in your development environment:

   a. In your app's build flow, navigate to the Local Test tab. Under Preview app, select Preview your app listing page.

   b. On the app's listing page, select Add for others.

   c. Select Users and groups, add the appropriate users, and select Allow.

3. To test users' access, sign in as one or more users, and confirm they have authorization to use the app and access the data successfully.

Best practices#

• Token scope: A bulk access token represents an administrator-authorized batch, not an individual user. Do not use it directly to call user-scoped APIs.
• Security: Keep the bulk access token confidential and use HTTPS for all requests.
• Retry logic: Implement retry logic in your client. User tokens may not be immediately available after creating a bulk access token due to asynchronous processing. Wait 1–2 minutes before attempting to exchange the bulk access token for user access tokens.
• Pagination consistency: Keep page_size consistent across all requests in a session. Changing it mid-session will invalidate the pagination cursor.
• Code handling: Treat bulk authorization codes with the same security controls as standard authorization codes. Do not reuse bulk codes and store all returned tokens securely.