zoom-oauth · openai — Claude skill: Zoom OAuth without guesswork
A Claude and Claude skill for Zoom authentication work: picking the grant flow, scope behaviour, refresh token rotation and error diagnosis.
npx skills add openai/plugins --skill oauth -a codexWhat zoom-oauth does
Reach for this skill when you wire an app into the Zoom API and the flow itself is the unclear part. It starts by pinning down the app type and actor: user-level OAuth, account-level OAuth, server-to-server where supported, SDK JWT, or Build-platform credentials. Then it asks which API, SDK or app surface you target, since scopes and token audiences shift between them.
What you get is a six-step workflow plus reference files: concepts/oauth-flows.md, concepts/token-lifecycle.md, concepts/scopes-architecture.md, references/granular-scopes.md, references/oauth-errors.md and troubleshooting/redirect-uri-issues.md. One step is easy to get wrong in code: refresh tokens are single-use, so persist the replacement token from each refresh response before the old one is reused. For local work the skill says keep access tokens out of logs.
The author points you at setup-zoom-oauth first for the initial setup plan, then back here for exact flows and error diagnosis. Validation covers redirect URI, account ID, scopes, app publication state and token expiration — do that before touching application code. If your case runs on SDK JWT, expect scope handling to differ from plain authorization code.
What it helps with
- pick the right grant flow for a Zoom app type
- explain why returned scopes differ from what you requested
- rotate refresh tokens without reusing the old one
- trace an OAuth failure back to its error code
- validate redirect URI before changing code
Example prompts for the agent
- Help me set up OAuth for an account-level Zoom app
- Why does the refresh response return a new refresh token and what do I do with it
- Walk me through this OAuth error when connecting to the Zoom API
How to install zoom-oauth
1Skills CLI (Vercel)
npx skills add openai/plugins --skill oauth -a codex2Manually: put the files in place
.agents/skills/oauth/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill oauth -a claude-code2Manually: put the files in place
~/.claude/skills/oauth/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/oauth/
Manually: put the files in place
.cursor/skills/oauth/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins oauth2Manually: put the files in place
.github/skills/oauth/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/zoom/skills/oauthManually: put the files in place
.devin/skills/oauth/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: Codex skills: how to install, where they live, how to call them
Questions about zoom-oauth
How do I install zoom-oauth in Claude?
Run npx skills add openai/plugins --skill oauth -a codex; the skill file then lives at .agents/skills/oauth/SKILL.md.
What does zoom-oauth do?
It covers Zoom authentication implementation: choosing a flow, scope behaviour, refresh token handling and diagnosing OAuth errors.
How is zoom-oauth different from setup-zoom-oauth?
The author recommends the other skill for a first-pass setup plan, and zoom-oauth for exact flows, scopes and error diagnosis.
Source text
SKILL.md · MIT
--- name: zoom-oauth description: Use when implementing OAuth. --- # Zoom OAuth Use this skill for concrete Zoom authentication implementation and troubleshooting. Prefer `setup-zoom-oauth` for the first-pass setup plan, then return here for exact flows, scope behavior, refresh handling, and error diagnosis. ## Workflow 1. Identify the app type and actor: user-level OAuth, account-level OAuth, server-to-server OAuth where officially supported, SDK JWT, or Build-platform credentials. 2. Confirm the target API, SDK, or app surface, because scopes and token audiences differ by surface. 3. Choose the grant flow: authorization code with PKCE for public clients, authorization code for confidential web apps, device authorization where appropriate, or account credentials for supported account-level automation. 4. Store refresh tokens as single-use values: persist the replacement refresh token returned by each refresh response before reusing the old one. 5. Validate requests against redirect URI, account ID, scopes, app publication state, and token expiration before changing application code. 6. For local development, keep access tokens out of logs and treat refresh tokens as single-use when rotating credentials. ## References - Full preserved guide: [references/full-guide.md](references/full-guide.md) - OAuth flows: [concepts/oauth-flows.md](concepts/oauth-flows.md) - Token lifecycle: [concepts/token-lifecycle.md](concepts/token-lifecycle.md) - Scope architecture: [concepts/scopes-architecture.md](concepts/scopes-architecture.md) - Granular scopes: [references/granular-scopes.md](references/granular-scopes.md) - OAuth errors: [references/oauth-errors.md](references/oauth-errors.md) - Redirect URI issues: [troubleshooting/redirect-uri-issues.md](troubleshooting/redirect-uri-issues.md)
© Zoom · MIT · openai/plugins
Similar skills
All skills for Backend and APIs →zoom-oauth by other authors comes first.
