AutoGineer
Generated banner for Setup Zoom Webhooks
Generated logo for Setup Zoom Webhooks

Setup Zoom Webhooks

AnthropicOfficialCreated by ZoomDistributed by Anthropic

  • Skill
  • Tool integration
  • Automation and integrations
  • MIT
  • No issues found
Download ZIP

From the author

Reference skill for Zoom webhooks. Use after routing to an event-driven workflow when implementing subscriptions, signature verification, delivery handling, retries, or event-type selection.
— the description by Zoom

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a technical reference for integrating Zoom webhooks into applications. It covers the essential steps for setting up event subscriptions, verifying incoming webhook signatures using HMAC, and handling event payloads. The documentation includes code examples for signature verification, a list of common event types, and links to community-maintained repositories for various programming languages.

What it does

  • Provides code patterns for verifying Zoom webhook signatures using HMAC-SHA256.
  • Lists common Zoom event types for meetings, recordings, users, and webinars.
  • Outlines prerequisites for receiving webhooks, including HTTPS endpoints and secret tokens.
  • Offers guidance on environment variable management for webhook secrets.
  • Links to official and community-contributed sample implementations across multiple languages.

When to use it

  • When setting up a new webhook listener for Zoom events.
  • When implementing signature verification to secure your webhook endpoint.
  • When troubleshooting issues with event delivery or payload parsing.
  • When looking for language-specific examples of Zoom webhook handlers.

Advantages

  • Centralizes essential configuration and security patterns for Zoom webhooks.
  • Provides a clear, reusable code pattern for signature verification.
  • Includes a comprehensive reference for event types and payload structures.
  • Connects developers to a variety of community-tested implementation samples.

Usage examples

“How do I verify a Zoom webhook signature in Node.js?”
The skill provides an Express.js code snippet demonstrating how to capture the raw request body and use crypto.createHmac to validate the x-zm-signature header.
“What events are available for Zoom recordings?”
The skill lists recording-related events such as recording.started, recording.completed, and recording.trashed.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/anthropics/setup-zoom-webhooks/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip setup-zoom-webhooks.zip -d .agents/skills

Documentation by Zoom

/setup-zoom-webhooks

Background reference for Zoom event delivery over HTTP. Prefer workflow skills first, then use this file for verification, subscription, and delivery details.

Prerequisites

  • Zoom app with Event Subscriptions enabled

  • HTTPS endpoint to receive webhooks

  • Webhook secret token for verification

Need help with authentication? See the zoom-oauth skill for OAuth setup.

Quick Start

// Express.js webhook handler
const crypto = require('crypto');

// Capture raw body for signature verification (avoid re-serializing JSON).
app.use(require('express').json({
  verify: (req, _res, buf) => { req.rawBody = buf; }
}));

app.post('/webhook', (req, res) => {
  // Verify webhook signature
  const signature = req.headers['x-zm-signature'];
  const timestamp = req.headers['x-zm-request-timestamp'];
  const body = req.rawBody ? req.rawBody.toString('utf8') : JSON.stringify(req.body);
  const payload = `v0:${timestamp}:${body}`;
  const hash = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(payload).digest('hex');
  
  if (signature !== `v0=${hash}`) {
    return res.status(401).send('Invalid signature');
  }

  // Handle event
  const { event, payload } = req.body;
  console.log(`Received: ${event}`);
  
  res.status(200).send();
});

Common Events

EventDescription
meeting.startedMeeting has started
meeting.endedMeeting has ended
meeting.participant_joinedParticipant joined meeting
recording.completedCloud recording ready
user.createdNew user added

Detailed References

Troubleshooting

Sample Repositories

Official (by Zoom)
TypeRepositoryStars
Node.jswebhook-sample34
PostgreSQLwebhook-to-postgres5
Go/FiberGo-Webhooks-
Header Authzoom-webhook-verification-headers-
Community
LanguageRepositoryDescription
Laravelbinary-cats/laravel-webhooksLaravel webhook handler
AWS Lambdasplunk/zoom-webhook-to-hecServerless to Splunk HEC
Node.jsWill4950/zoom-webhook-listenerWebhook forwarder
Express+Redisojusave/eventSubscriptionPlaygroundSocket.io + Redis
Multi-Language Samples (by tanchunsiong)
LanguageRepository
Node.jsZoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-NodeJS
C#Zoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-ASP.NET-Core-C-
JavaZoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-Java-Spring-Boot
PythonZoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-Python
PHPZoom-Webhook-Signature-OAuth-and-REST-API-Development-Sample-In-PHP

Full list: See general/references/community-repos.md

Resources

Environment Variables

Files

troubleshooting/common-issues.md

Common Issues

Quick diagnostics for Zoom Webhooks integrations.

Signature Verification Fails (401 / "Invalid signature")

Common causes:

  • You are computing the HMAC over a re-serialized body (different whitespace/key order).

  • You are using the wrong secret (webhook secret vs OAuth secret).

  • You are not including the v0:{timestamp}:{body} prefix exactly.

Fix:

  • Verify signatures using the exact raw request body bytes (capture raw body before JSON parsing).

  • Validate both x-zm-signature and x-zm-request-timestamp and reject stale timestamps (replay protection).

See: verification.md

Timeouts / Retries / Duplicate Events

Symptom: Zoom retries delivery, you process the same event multiple times.

Fix:

  • Respond fast (acknowledge ASAP, then enqueue work).

  • Make handlers idempotent (dedupe by event ID/timestamp + payload identifiers).

URL Validation Fails

Symptom: You can’t enable the webhook endpoint in Marketplace; validation fails.

Fix:

  • Implement endpoint.url_validation response correctly (plainToken + encryptedToken).

See: verification.md

Requirements and compatibility

Written for: Claude Code, Claude apps

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Zoom
Publisher
Anthropic (Official)
Distributed by
Anthropic
Source
anthropics/knowledge-work-plugins · partner-built/zoom-plugin/skills/webhooks · commit e050c2e
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from partner-built/zoom-plugin/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Zoom or Anthropic.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download setup-zoom-webhooks.zip