Zoom Marketplace Portal Checklist

Complete these steps in developers.zoom.us before resubmitting Obuchat Assistant.

1. Account Credentials

• Fill docs/zoom-marketplace-credentials.template.txt with real Telegram phone + Zoom email/password.
• Paste into App Submission → Account Credentials.
• Run scripts/add_zoom_reviewer_allowlist.sh [TELEGRAM_USER_ID] on production after creating the test Telegram account.

2. App Gallery images

See screenshot checklist — upload 5–7 images in App Submission → App Gallery.

3. Short Description (≤150 characters)

Paste into App Submission → Short Description:

Create, reschedule, and delete Zoom meetings from Telegram. Auto-attach links to Google Calendar and view recordings in the Mini App profile.

148 characters.

4. Developer Contact Email

• Set Developer Contact Information → Email to support@obuchat.me (corporate domain).
• Do not use a personal Gmail/Yahoo address.

5. Regenerate Authorization URL (required before submit)

Do this after all scope, Surface, and redirect changes are saved. Zoom requires a fresh URL when app configuration changed.

1. Open your app at marketplace.zoom.us → Develop → Manage.
2. Switch to the Production tab (not Development — first-time submission must use Production Client ID).
3. Go to Local Test (or Share App / App Submission if shown there).
4. Find Authorization URL → click Generate or Regenerate → Copy.
5. Paste the copied URL into App Submission if there is an Authorization URL field, and into Release notes for app reviewer.
6. Verify the URL contains client_id=25bg0QtHTVyrLWzx1WQwgQ and redirect_uri=https://assistant.obuchat.me/oauth/zoom/callback (URL-encoded is OK).

Expected base (bot adds state + scope at runtime via /zoom_auth):

https://zoom.us/oauth/authorize?response_type=code&client_id=25bg0QtHTVyrLWzx1WQwgQ&redirect_uri=https://assistant.obuchat.me/oauth/zoom/callback

If the portal-generated URL also includes a scope= parameter, use the portal version — it reflects your current 5 scopes.

6. Redirect URLs (Development vs Production)

Use matching Client ID + Secret from each tab on the corresponding server only.

7. Scopes — remove Optional; disable Zoom App (in-client)

• Scopes: uncheck Optional for all five required scopes (see release notes).
• App type: General OAuth only — disable Zoom App / in-client / Surface option.

8. Surface → Meeting

Unselect Meeting under Features → Surface. This app does not run inside the Zoom meeting client.

9. Scopes list (exactly 6 — remove everything else)

Keep only these. Remove user:read:zak, zoomapp:inmeeting, cloud_recording:read:recording.

• user:read:user
• user:read:token — required for note-taking agent (OBF / Zoom SDK join)
• meeting:write:meeting
• meeting:read:list_meetings — required so delete/reschedule can list then DELETE/PATCH
• meeting:update:meeting
• meeting:delete:meeting

After changing scopes: Save → regenerate Production Authorization URL → ask reviewers to re-authorize (revoke under Added Apps, then /zoom_auth again).

Pre-submit checklist

1. Account Credentials filled with real test accounts
2. 5–7 App Gallery screenshots uploaded
3. Short Description pasted
4. Developer Contact = support@obuchat.me
5. Dev and Prod redirect URLs differ
6. No optional scope markings; Zoom App / in-client disabled
7. Meeting surface unselected
8. Authorization URL regenerated on Production tab (after scope/Surface changes)
9. Test plan URL in submission points to https://assistant.obuchat.me/docs/zoom-test-plan.html