Test Zoom webhooks locally

Start your appCopy Anchor Link

Zoom sends two checks. The handler covers both.

1. Endpoint URL validation. When you validate the URL, Zoom sends an endpoint.url_validation event with a plainToken. Reply with 200 and JSON holding the plainToken and an encryptedToken. The encryptedToken is the HMAC SHA256 of plainToken, keyed with your secret token, as a hex digest. Zoom wants the reply within three seconds.
2. Signature check. Every other event carries x-zm-signature and x-zm-request-timestamp. Build the string v0:<timestamp>:<raw body>, compute its HMAC SHA256 with the secret token, and prefix the hex digest with v0=.

Read the body with request.text() before you parse it.

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const secretToken = process.env.ZOOM_WEBHOOK_SECRET_TOKEN;
  if (!secretToken) {
    return new Response("Missing ZOOM_WEBHOOK_SECRET_TOKEN", { status: 500 });
  }

  const body = await request.text();
  const payload = JSON.parse(body);

  if (payload.event === "endpoint.url_validation") {
    const encryptedToken = createHmac("sha256", secretToken)
      .update(payload.payload.plainToken)
      .digest("hex");
    return Response.json({
      plainToken: payload.payload.plainToken,
      encryptedToken,
    });
  }

  const timestamp = request.headers.get("x-zm-request-timestamp") ?? "";
  const received = request.headers.get("x-zm-signature") ?? "";
  const expected = `v0=${createHmac("sha256", secretToken)
    .update(`v0:${timestamp}:${body}`)
    .digest("hex")}`;

  const receivedBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  const isValid =
    receivedBuffer.length === expectedBuffer.length &&
    timingSafeEqual(receivedBuffer, expectedBuffer);

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  console.log(`Received Zoom event: ${payload.event}`);
  return new Response("ok", { status: 200 });
}

Store the secret token in an environment variable.

ZOOM_WEBHOOK_SECRET_TOKEN=your-webhook-secret-token

Start the app on port 3000.

npm run dev

Start a tunnelCopy Anchor Link

Use -s with a subdomain you reserved. Without it, the subdomain is random and changes every run, so Zoom would point at a dead URL after a restart. Reserve it first on the Subdomains page. Reserved subdomains are a paid feature, see Pricing.

hrzn tunnel http://localhost:3000 -s my-zoom-app

Horizon prints HORIZON: Tunnel connected. Your public URL is https://my-zoom-app.hrzn.run. Keep this terminal open.

Add the endpoint in ZoomCopy Anchor Link

1. Open your app in the Zoom App Marketplace.
2. Go to Features, then Access.
3. Turn on Event Subscriptions and select Add New Event Subscription.
4. On the Event Types screen, select the events you need, for example meeting.started.
5. Set Event notification endpoint URL to https://my-zoom-app.hrzn.run/api/webhooks/zoom.
6. Select Validate.
7. After validation succeeds, select Save.

Zoom shows your webhook secret token on the Add Feature page for your app. Copy it into ZOOM_WEBHOOK_SECRET_TOKEN and restart npm run dev.

Trigger an eventCopy Anchor Link

The Zoom docs describe no resend or event simulator in the Marketplace. Trigger a real event instead. With meeting.started selected, start a meeting on the Zoom account that owns the app.

For past deliveries, Zoom offers a Get webhook logs API. It lists webhooks sent to your app.