setup-zoom-webhooks

This is a background reference skill for implementing Zoom event delivery over HTTP webhooks. It addresses the practical work of receiving, verifying, and handling Zoom events reliably, covering subscriptions, HMAC signature verification, delivery handling, retries, and event-type selection. It is meant to be consulted after a workflow skill has routed the developer to an event-driven approach.

The skill provides a quick-start Express.js handler that captures the raw request body and verifies the x-zm-signature header by computing an HMAC-SHA256 over a v0:timestamp:body payload using a webhook secret token, rejecting mismatches with a 401. It documents common event types (meeting.started, meeting.ended, participant joined, recording.completed, user.created), how to configure subscriptions both through the Zoom Marketplace portal and programmatically via the Webhook Subscriptions API, and skill-chaining patterns that combine REST API calls with event-driven flows. Supporting reference files cover environment variables (ZOOM_WEBHOOK_SECRET and aliases stored server-side only), full event catalogs, URL validation, and troubleshooting, plus a curated list of official and community sample repositories across Node.js, Go, PHP, Java, Python, C#, and more.

It targets backend developers and integrators building Zoom automations such as real-time meeting tracking, automated recording pipelines, and user lifecycle management. The signature-verification and secret-handling guidance is security-conscious, recommending keeping the webhook secret in server-side secret storage.