zoom-apps-sdk

The zoom-apps-sdk skill is a comprehensive reference for building web apps that run inside the Zoom client, covering meetings, webinars, the main client, and Zoom Phone. It solves the problem of learning the @zoom/appssdk JavaScript API and its runtime constraints, which differ substantially from ordinary web development because the app runs inside Zoom's embedded browser with domain allowlisting, running-context awareness, and specific security requirements.

The skill is organized as a documentation hub with concept guides (architecture, running contexts, security, Meeting SDK versus Zoom Apps), worked examples (quick start Express + SDK app, in-client OAuth with PKCE, Layers immersive and camera modes, Collaborate Mode, breakout rooms, guest mode, app communication), API and events references, and troubleshooting guides for common issues, debugging, and migration. It documents SDK capability groups including context APIs, meeting actions, in-client OAuth authorization, the Layers API for immersive video layouts, Collaborate Mode for shared app state, app communication between instances, media controls, and UI controls. Its security concept file is notably defensive, prescribing OWASP response headers, TLS 1.2 minimum, SameSite=None Secure cookies for cross-origin embedding, PKCE for OAuth, server-side token storage (never in frontend storage), OAuth state parameter validation against CSRF, least-privilege scopes, and a marketplace security review checklist.

Intended users are web developers building in-client Zoom apps who need both a getting-started path and deep reference material. Prerequisites include a Zoom App type registration in the Marketplace, OAuth credentials, a Node.js/Express backend, a whitelisted domain, and an HTTPS tunnel such as ngrok for local development. The credential handling it documents is standard and security-conscious, using environment variables for secrets and explicitly warning against logging sensitive data.