Setup Zoom Webhooks — Agent Skill by Anthropic

From the author

Reference skill for Zoom webhooks. Use after routing to an event-driven workflow when implementing subscriptions, signature verification, delivery handling, retries, or event-type selection.

— the description by Zoom

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a technical reference for integrating Zoom webhooks into applications. It covers the essential steps for setting up event subscriptions, verifying incoming webhook signatures using HMAC, and handling event payloads. The documentation includes code examples for signature verification, a list of common event types, and links to community-maintained repositories for various programming languages.

What it does

Provides code patterns for verifying Zoom webhook signatures using HMAC-SHA256.
Lists common Zoom event types for meetings, recordings, users, and webinars.
Outlines prerequisites for receiving webhooks, including HTTPS endpoints and secret tokens.
Offers guidance on environment variable management for webhook secrets.
Links to official and community-contributed sample implementations across multiple languages.

When to use it

When setting up a new webhook listener for Zoom events.
When implementing signature verification to secure your webhook endpoint.
When troubleshooting issues with event delivery or payload parsing.
When looking for language-specific examples of Zoom webhook handlers.

Advantages

Centralizes essential configuration and security patterns for Zoom webhooks.
Provides a clear, reusable code pattern for signature verification.
Includes a comprehensive reference for event types and payload structures.
Connects developers to a variety of community-tested implementation samples.

Usage examples

“How do I verify a Zoom webhook signature in Node.js?”: The skill provides an Express.js code snippet demonstrating how to capture the raw request body and use crypto.createHmac to validate the x-zm-signature header.
“What events are available for Zoom recordings?”: The skill lists recording-related events such as recording.started, recording.completed, and recording.trashed.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/anthropics/setup-zoom-webhooks/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip setup-zoom-webhooks.zip -d .agents/skills

Documentation by Zoom

/setup-zoom-webhooks

Background reference for Zoom event delivery over HTTP. Prefer workflow skills first, then use this file for verification, subscription, and delivery details.

Prerequisites

Zoom app with Event Subscriptions enabled
HTTPS endpoint to receive webhooks
Webhook secret token for verification

Need help with authentication? See the zoom-oauth skill for OAuth setup.

Quick Start

// Express.js webhook handler
const crypto = require('crypto');

// Capture raw body for signature verification (avoid re-serializing JSON).
app.use(require('express').json({
  verify: (req, _res, buf) => { req.rawBody = buf; }
}));

app.post('/webhook', (req, res) => {
  // Verify webhook signature
  const signature = req.headers['x-zm-signature'];
  const timestamp = req.headers['x-zm-request-timestamp'];
  const body = req.rawBody ? req.rawBody.toString('utf8') : JSON.stringify(req.body);
  const payload = `v0:${timestamp}:${body}`;
  const hash = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(payload).digest('hex');
  
  if (signature !== `v0=${hash}`) {
    return res.status(401).send('Invalid signature');
  }

  // Handle event
  const { event, payload } = req.body;
  console.log(`Received: ${event}`);
  
  res.status(200).send();
});

Common Events

Event	Description
`meeting.started`	Meeting has started
`meeting.ended`	Meeting has ended
`meeting.participant_joined`	Participant joined meeting
`recording.completed`	Cloud recording ready
`user.created`	New user added

Detailed References

references/events.md - Complete event types reference
references/verification.md - Webhook URL validation
references/subscriptions.md - Event subscriptions API

Troubleshooting

RUNBOOK.md - 5-minute preflight checks before deep debugging
troubleshooting/common-issues.md - Signature verification, retries, URL validation

Sample Repositories

Official (by Zoom)

Type	Repository	Stars
Node.js	webhook-sample	34
PostgreSQL	webhook-to-postgres	5
Go/Fiber	Go-Webhooks	-
Header Auth	zoom-webhook-verification-headers	-

Community

Language	Repository	Description
Laravel	binary-cats/laravel-webhooks	Laravel webhook handler
AWS Lambda	splunk/zoom-webhook-to-hec	Serverless to Splunk HEC
Node.js	Will4950/zoom-webhook-listener	Webhook forwarder
Express+Redis	ojusave/eventSubscriptionPlayground	Socket.io + Redis

Multi-Language Samples (by tanchunsiong)

Language	Repository
Node.js	Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-NodeJS
C#	Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-ASP.NET-Core-C-
Java	Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-Java-Spring-Boot
Python	Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-Python
PHP	Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-PHP

Full list: See general/references/community-repos.md

Resources

Webhook docs: https://developers.zoom.us/docs/api/webhooks/
Event reference: https://developers.zoom.us/docs/api/rest/reference/zoom-api/events/
Developer forum: https://devforum.zoom.us/

Environment Variables

See references/environment-variables.md for standardized .env keys and where to find each value.

Files

ATTRIBUTION.mdAdded by AutoGineer983 B
LICENSELicence file added by AutoGineer1.1 KiB
RUNBOOK.md2.6 KiB
SKILL.md5.0 KiB
references/environment-variables.md642 B
references/events.md1.9 KiB
references/signature-verification.md161 B
references/subscriptions.md7.2 KiB
references/verification.md2.2 KiB
troubleshooting/common-issues.md1.2 KiB

RUNBOOK.md

Webhooks 5-Minute Preflight Runbook

Use this before deep debugging. It catches common webhook failures quickly.

Skill Doc Standard Note

Agent-skill standard entrypoint is SKILL.md.
This runbook is an operational convention (recommended), not a required skill file.
SKILL.md is also a navigation convention for larger skill docs.

1) Confirm Endpoint Reachability

Public HTTPS endpoint is reachable from Zoom.
Reverse proxy routes to the correct service path.

2) Confirm Signature Verification

Verify x-zm-signature with raw request body.
Use x-zm-request-timestamp and reject stale timestamps.
Do not re-serialize parsed JSON for signature material.

Signature Formula Reminder

payload = "v0:" + x-zm-request-timestamp + ":" + raw_body
expected = "v0=" + HMAC_SHA256(webhook_secret, payload)

If raw_body differs from original bytes (pretty print/re-stringify), verification fails.

3) Confirm URL Validation Handling

Handle endpoint.url_validation challenge correctly.
Return expected plainToken and computed encryptedToken when required.

URL Validation Reminder

On event = endpoint.url_validation, hash payload.plainToken with your webhook secret and return both values exactly.

4) Confirm Event Subscription Setup

Feature/Event subscriptions enabled in app config.
Required event types selected and saved.

5) Confirm Processing Pattern

Respond HTTP 200 quickly.
Process business logic asynchronously.
Make handlers idempotent for retries.

6) Quick Probes

Local test payload verifies signature path.
Zoom test event reaches endpoint and is logged.
No repeated non-200 responses in logs.

Copy/Paste Validation Commands

# 1) Reachability check (replace with your webhook route)
curl -sS -i "https://your-domain.example/webhook"

# 2) Check service logs quickly while sending test events
# (replace command with your runtime: pm2/docker/systemd)
pm2 logs your-service --lines 100

# 3) Basic endpoint health check if available
curl -sS -i "https://your-domain.example/health"

Expected: endpoint is reachable over HTTPS, events appear once, and responses are consistently 2xx.

7) Fast Decision Tree

No events received -> endpoint unreachable or wrong subscription.
401 invalid signature -> raw body mismatch/secret mismatch.
Duplicate events -> no idempotency or delayed responses.

8) Retry and Idempotency Guardrail

Treat webhook delivery as at-least-once.
Deduplicate by event ID/timestamp/resource key before side effects.
Keep handlers safe to re-run.

Requirements and compatibility

Written for: Claude Code, Claude apps

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Build MCP App
AnthropicOfficial
Build interactive UI widgets for MCP servers to render forms, pickers, and dashboards directly within the chat interface.
Automation and integrationsClaude CodeClaude appsOpenAI Codex+14 more
Apache-2.0GitHub stars of the source repository46.3k
MCP Integration
AnthropicOfficial
Comprehensive guide for integrating Model Context Protocol (MCP) servers into Claude Code plugins.
Automation and integrationsClaude CodeClaude appsOpenAI Codex+14 more
Apache-2.0GitHub stars of the source repository46.3k
Social Publishing
Seth Hobson· Community
Programmatically schedule and publish content across 13 social media platforms using the SocialClaw API.
Automation and integrationsClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
Hermes Tweet
Seth Hobson· Community
Integrates X/Twitter research and action capabilities into the Hermes Agent framework with strict approval-gated security.
Automation and integrationsClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
Paypal Integration
Seth Hobson· Community
A guide to integrating PayPal payment processing, including checkout flows, subscriptions, and IPN webhook handling.
Automation and integrationsClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
Social Publishing Publisher
Seth Hobson· Community
An agent-driven social media publishing specialist for multi-platform campaign management via the SocialClaw API.
Automation and integrationsClaude Code
MITGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download setup-zoom-webhooks.zip