Home/Glossary/Zoom ZAK

What is Zoom ZAK?

A Zoom Access Key (ZAK) is a per-user token issued by Zoom.

It lets a Meeting SDK client join or start meetings as that user.

In the past it was how meeting bots signed in on Zoom.

Your integration fetched a ZAK for a Zoom user with GET /users/{userId}/token?type=zak.

It then passed the key to the SDK at join time, with no consent step by that end user.

Your appuser:read OAuthZAKper-user tokenSDK clientpresents itBot joinsown-account meetings
A token fetched for a user; the SDK client presents it at join time.

How a ZAK is used

Four steps, from an OAuth app to a bot in the call.

An OAuth appWith the user:readscopeConsentThe user or an accountadminFetch a ZAKThrough Zoom's APIThe SDK joinsPresenting the ZAKAn OAuth appWith the user:read scopeConsentThe user or an account adminFetch a ZAKThrough Zoom's APIThe SDK joinsPresenting the ZAK
One scope, one token, one join.

On MeetStream a ZAK-based join is handled for you.

You do not pass token URLs yourself, and MeetStream refreshes the key as needed.

Scope and lifetime

A ZAK issued in the host role can also start a meeting.

An OBF token is scoped to joining one.

User typeThe ZAK lastsTypical useA regular userAbout two hoursEveryday joinsA custCreate user90 daysLonger-lived integrationsA custom lifetimeUp to a yearSet when the token is issuedA regular userThe ZAK lasts: About two hoursTypical use: Everyday joinsA custCreate userThe ZAK lasts: 90 daysTypical use: Longer-lived integrationsA custom lifetimeThe ZAK lasts: Up to a yearTypical use: Set when the token is issued
Three lifetimes, depending on how the Zoom user was made.

Why Zoom moved to OBF

A ZAK is a credential your integration holds, then hands to the bots it starts for that user.

You, not Zoom, own attribution and revocation.

Zoom's OBF model replaced that with a per-user connection, required since 2 March 2026 for meetings hosted outside your own account.

ZAK still works for meetings on your own Zoom account. External meetings need OBF, so new integrations should start there.

ZAKOBF
CredentialA per-user token your integration fetchesOne consented connection per end user
ConsentNone from the end userEach user authorises your app once
RevocationRotate the token on your sideDelete one connection
Best forInternal tools on your own accountProducts whose customers connect their own Zoom
FAQ

Frequently asked questions

Is ZAK still supported on MeetStream?

Yes, for meetings on your own Zoom account.

OBF is the path for external meetings, and the one we recommend for new integrations.

Do I fetch the ZAK myself?

No. MeetStream manages the token side; do not pass zak_url or obf_url fields in create_bot.

Which should I choose?

OBF for anything with customers; ZAK only for bots on your own Zoom account.

Can a ZAK start a meeting?

Yes, when it is issued in the host role. An OBF token is scoped to joining a meeting.

Put the vocabulary to work

One API to join, record, stream and transcribe meetings across Zoom, Google Meet and Microsoft Teams.