# What is Zoom ZAK?

> A Zoom Access Key (ZAK) is a per-user token issued by Zoom that lets a Meeting SDK client join or start meetings as that user. Historically it was.

Source: https://meetstream.ai/glossary/zoom-zak

*By Sidhdharth Sivasubramanian, Co-founder and CEO, MeetStream*

A Zoom Access Key (ZAK) is a per-user token issued by Zoom.

It lets a Meeting SDK client join or start meetings as that user.

In the past it was how meeting bots signed in on Zoom.

Your integration fetched a ZAK for a Zoom user with GET /users/{userId}/token?type=zak.

It then passed the key to the SDK at join time, with no consent step by that end user.

- **Your app**: user:read OAuth
- **ZAK**: per-user token
- **SDK client**: presents it
- **Bot joins**: own-account meetings

*A token fetched for a user; the SDK client presents it at join time.*

## How a ZAK is used

Four steps, from an OAuth app to a bot in the call.

- **An OAuth app**: With the user:read scope
- **Consent**: The user or an account admin
- **Fetch a ZAK**: Through Zoom's API
- **The SDK joins**: Presenting the ZAK

*One scope, one token, one join.*

On MeetStream a ZAK-based join is handled for you.

You do not pass token URLs yourself, and MeetStream refreshes the key as needed.

## Scope and lifetime

A ZAK issued in the host role can also start a meeting.

An [OBF token](https://meetstream.ai/glossary/zoom-obf) is scoped to joining one.

- User type
- The ZAK lasts
- Typical use
- **A regular user**: About two hours Everyday joins
- **A custCreate user**: 90 days Longer-lived integrations
- **A custom lifetime**: Up to a year Set when the token is issued

*Three lifetimes, depending on how the Zoom user was made.*

## Why Zoom moved to OBF

A ZAK is a credential your integration holds, then hands to the bots it starts for that user.

You, not Zoom, own attribution and revocation.

Zoom's [OBF model](https://meetstream.ai/glossary/zoom-obf) replaced that with a per-user connection, required since 2 March 2026 for meetings hosted outside your own account.

ZAK still works for meetings on your own Zoom account. External meetings need OBF, so new integrations should start there.

| | ZAK | OBF |
|---|---|---|
| Credential | A per-user token your integration fetches | One consented connection per end user |
| Consent | None from the end user | Each user authorises your app once |
| Revocation | Rotate the token on your side | Delete one connection |
| Best for | Internal tools on your own account | Products whose customers connect their own Zoom |

## Frequently asked questions

### Is ZAK still supported on MeetStream?

Yes, for meetings on your own Zoom account.

OBF is the path for external meetings, and the one we recommend for new integrations.

### Do I fetch the ZAK myself?

No. MeetStream manages the token side; do not pass zak_url or obf_url fields in create_bot.

### Which should I choose?

OBF for anything with customers; ZAK only for bots on your own Zoom account.

### Can a ZAK start a meeting?

Yes, when it is issued in the host role. An OBF token is scoped to joining a meeting.

## Keep exploring

- [Zoom OBF](https://meetstream.ai/glossary/zoom-obf): Glossary
- [Zoom integration](https://meetstream.ai/integrations/zoom): Integration
- [Zoom RTMS](https://meetstream.ai/glossary/zoom-rtms): Glossary
- [Zoom meeting bot API](https://meetstream.ai/meeting-bot-api/zoom): Product
- [Meeting bot](https://meetstream.ai/glossary/meeting-bot): Glossary
- [Bot lifecycle](https://meetstream.ai/glossary/bot-lifecycle): Glossary

## Put the vocabulary to work

One API to join, record, stream and transcribe meetings across Zoom, Google Meet and Microsoft Teams.

---

Full site index for agents: https://meetstream.ai/llms.txt
API contract (OpenAPI 3.1): https://meetstream.ai/openapi.json
MCP discovery: https://meetstream.ai/.well-known/mcp