How to Build a SaaS App on the Zoom Marketplace with 3rd Party OAuth2

TL;DR: This post breaks down the architecture behind VideoSync—a SaaS tool that auto-uploads Zoom recordings to Google Drive, Vimeo, and YouTube. You'll learn how to get listed on the Zoom Marketplace, handle webhooks, and implement secure OAuth2 flows for third-party integrations.

Table of Contents:

• Why Build on the Zoom Marketplace?
• Setting Up Your Zoom App
• Setting Up Zoom Webhooks
• Implementing OAuth2 with Google Drive
• Adding Vimeo OAuth
• Final Thoughts

Why Build on the Zoom Marketplace?

Zoom is the backbone of remote work—and millions of hours of video content are generated every day. But there’s a catch: getting recordings off Zoom and into places like Google Drive, YouTube, or Vimeo often means a ton of manual work.

That’s where VideoSync comes in. The goal: after a Zoom call ends, your video magically appears in the cloud destinations you’ve connected. No downloads, no uploads.

To do this, we needed to:

• Build a Zoom Marketplace app
• Automate video processing with webhooks
• Support third-party OAuth2 providers (Google, Vimeo, YouTube)

Setting Up Your Zoom App

Zoom’s approval process is no joke. But with the right preparation, it’s smooth:

✅ Set Up an OAuth App

• Go to marketplace.zoom.us
• Create a new OAuth app (choose Account-level)
• Add your redirect URL (e.g. https://yourapp.com/api/zoom/callback)
• Define scopes like:
  • recording:read:admin
  • user:read

Setting Up Zoom Webhooks

Once your Zoom app is approved, you can listen for events like recording.completed to trigger downstream uploads.

// /pages/api/zoom/webhook.ts
export default async function handler(req, res) {
  const { event, payload } = req.body;
 
  if (event === 'recording.completed') {
    const { recording_files, meeting_uuid } = payload.object;
 
    // 1. Download recording_files[n].download_url with Zoom OAuth token
    // 2. Upload to Google Drive, YouTube, or Vimeo
    // 3. Update DB with job status
  }
 
  res.status(200).end();
}

⁉️ Looking for a more in-depth view for how I implemented this part of the flow? Stay-tuned for another blog post coming soon!

Implementing OAuth2 with Google Drive

This is how we securely connect a user’s Google Drive account and upload their Zoom recordings to a selected folder.

1. Start the OAuth2 Flow

// /api/oauth/google/start.ts
const base = 'https://accounts.google.com/o/oauth2/v2/auth';
const params = new URLSearchParams({
  client_id: process.env.GOOGLE_CLIENT_ID!,
  redirect_uri: process.env.GOOGLE_REDIRECT_URI!,
  response_type: 'code',
  scope: 'https://www.googleapis.com/auth/drive.file',
  access_type: 'offline',
  prompt: 'consent',
});
res.redirect(`${base}?${params.toString()}`);

2. Handle the Callback

// /api/oauth/google/callback.ts
const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    code: req.query.code as string,
    client_id: process.env.GOOGLE_CLIENT_ID!,
    client_secret: process.env.GOOGLE_CLIENT_SECRET!,
    redirect_uri: process.env.GOOGLE_REDIRECT_URI!,
    grant_type: 'authorization_code',
  }),
});
const tokens = await tokenRes.json();
// Save access_token and refresh_token securely

Adding Vimeo OAuth

Vimeo follows the same pattern with some minor differences:

• Token exchange uses Basic Auth (client ID and secret encoded in the header)
• Scopes passed as a space-delimited scope parameter

Prepare for Marketplace Review

Zoom reviewers will test your app, so:

• Offer a clear walkthrough (we used Loom)
• Note any third-party services that may not work unless their email is whitelisted (Google, YouTube)
• Provide a test login flow — we used email OTP
• Link to your Terms of Service and Privacy Policy

Here’s a quick checklist that helped us:

☑️ TOS and Privacy links
☑️ Test account with trial access
☑️ Explanation of whitelisting limitations
☑️ Webhook tested in staging

Final Thoughts

Getting VideoSync listed on the Zoom Marketplace took time—but it made the product feel real. The combo of webhooks + third-party OAuth2 makes it feel magical for users: no more downloading Zoom videos, no more uploading to 3 platforms.

If you’re building a SaaS that touches video, automation, or remote workflows, you want to be in Zoom’s ecosystem. Just be ready for scopes, webhook events, and the OAuth2 rabbit hole.

Want to see the final product? Sign up completely for free at VideoSync.cloud 🚀