Zoom Webhooks

When to Use This Skill

• How do I receive Zoom webhooks?
• How do I verify Zoom webhook signatures?
• How do I complete the Zoom endpoint.url_validation handshake?
• How do I handle meeting.started, meeting.ended, or recording.completed events?
• Why is my Zoom webhook signature verification failing?

Verification (core)

Zoom signs each webhook with HMAC-SHA256 (hex) keyed on your app's Secret Token. Build the message v0:{x-zm-request-timestamp}:{raw body}, hash it, and prefix with v0=. Compare against the x-zm-signature header timing-safe. Always use the raw body — parsing to JSON first changes the bytes and breaks the signature.

Zoom also requires a one-time URL validation handshake: when event === "endpoint.url_validation", respond 200 with { plainToken, encryptedToken } where encryptedToken = HMAC-SHA256(plainToken, secretToken) in hex. Respond to every webhook within 3 seconds.

const crypto = require('crypto');