From 9c1de271076186815517f38efdc9ee29416d568f Mon Sep 17 00:00:00 2001 From: staugaard Date: Mon, 19 Oct 2026 10:32:15 +1300 Subject: [PATCH] zoom: require Client Secret with Client ID (1.0.2) --- third_party/zoom/.cursor-plugin/plugin.json | 10 +++++----- third_party/zoom/CHANGELOG.md | 6 ++++++ third_party/zoom/README.md | 10 +++++----- 3 files changed, 16 insertions(+), 10 deletions(-) diff --git a/third_party/zoom/.cursor-plugin/plugin.json b/third_party/zoom/.cursor-plugin/plugin.json index 7a0ac4fc2..9f630f86e 100644 --- a/third_party/zoom/.cursor-plugin/plugin.json +++ b/third_party/zoom/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "zoom", "displayName": "Zoom", - "version": "1.0.1", + "version": "1.0.2", "description": "Search meetings, pull transcripts, and work with Zoom Docs.", "author": { "name": "Cursor", @@ -30,13 +30,13 @@ "properties": { "CLIENT_ID": { "type": "string", - "title": "Zoom Client ID", - "description": "Public Client ID (recommended) or Client ID from your Zoom App Marketplace General app → Basic Information → App Credentials. The Public Client ID appears after turning on Use Public Client OAuth." + "title": "Zoom Client ID or Public Client ID", + "description": "A Client Secret is required along with the Client ID. A Public Client ID takes no secret; it appears after turning on Use Public Client OAuth. Copy either from your Zoom App Marketplace General app → Basic Information → App Credentials." }, "CLIENT_SECRET": { "type": "string", - "title": "Zoom Client Secret", - "description": "Optional. Leave blank with a Public Client ID; Cursor then signs in with PKCE and no secret. Only set it alongside the confidential Client ID from the same app." + "title": "Zoom Client Secret (needed with the Client ID)", + "description": "Required along with the Client ID, from the same app's App Credentials. Leave it blank only with a Public Client ID; Cursor then signs in with PKCE and no secret." } }, "required": [ diff --git a/third_party/zoom/CHANGELOG.md b/third_party/zoom/CHANGELOG.md index 20f86f1d0..5e28457ec 100644 --- a/third_party/zoom/CHANGELOG.md +++ b/third_party/zoom/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to this plugin will be documented here. +## 1.0.2 + +- Setup copy now leads with the Client Secret being required along with the Client ID. Zoom rejects a Client ID sent without its secret with `invalid_client` at the token exchange. +- Retitled the variables "Zoom Client ID or Public Client ID" and "Zoom Client Secret (needed with the Client ID)", and dropped "Optional." from the secret's description. +- README: the setup steps offer the Client ID and Client Secret first and the Public Client ID as the no-secret option, and note that a regenerated secret must be entered again in Cursor. + ## 1.0.1 - Made `CLIENT_SECRET` optional so a Zoom Public Client ID signs in with PKCE and no secret, which is what Zoom requires for the desktop loopback redirect. diff --git a/third_party/zoom/README.md b/third_party/zoom/README.md index 46c110833..a9649125f 100644 --- a/third_party/zoom/README.md +++ b/third_party/zoom/README.md @@ -8,7 +8,7 @@ Search meetings and recordings, pull summaries and transcripts, and work with Zo 1. Open **Cursor Settings → Plugins**. 2. Search for **Zoom**. -3. Click **Install**, then set the client ID (below) and complete the Zoom sign-in prompt. +3. Click **Install**, then set the Client ID and the Client Secret it requires, or a Public Client ID (below), and complete the Zoom sign-in prompt. Or run `/add-plugin zoom` in chat. @@ -38,13 +38,13 @@ Zoom's MCP servers only support manual client registration — Dynamic Client Re 3. Under **Basic Information → OAuth Information**, register both redirect URIs: - Desktop: `http://127.0.0.1:8787/callback` - Web and Cloud Agents: `https://www.cursor.com/agents/mcp/oauth/callback` -4. Under **Basic Information → App Credentials**, turn on **Use Public Client OAuth** and copy the **Public Client ID**. -5. In **Dashboard → Plugins → Configure**, set **Zoom Client ID** to that Public Client ID and leave **Zoom Client Secret** blank. +4. Under **Basic Information → App Credentials**, copy the **Client ID** and **Client Secret**. A Client Secret is required along with the Client ID. To sign in without a secret instead, turn on **Use Public Client OAuth** and copy the **Public Client ID**. +5. In **Dashboard → Plugins → Configure**, set **Zoom Client ID or Public Client ID** and **Zoom Client Secret** to the values you copied. Leave the secret blank only with the Public Client ID. 6. Complete the Zoom OAuth login when Cursor prompts. -Zoom only accepts a loopback redirect such as `http://127.0.0.1:8787/callback` for a public client, and rejects `localhost` outright. A public client proves each sign-in with PKCE instead of a shared secret, so there is no secret to store or leak. The confidential Client ID and Client Secret pair still works for Web and Cloud Agents, but Zoom refuses its desktop loopback redirect. +If you regenerate the Client Secret in Zoom, enter the new one in Cursor too. Desktop sign-ins through the loopback redirect need the Public Client ID: Zoom accepts `http://127.0.0.1:8787/callback` only for a public client, and rejects `localhost` outright. -Each member needs a license for the Zoom products they want to reach. On a team marketplace an admin sets the client ID once for everyone; each member still completes their own Zoom OAuth login, so tool calls run with that member's Zoom permissions. +Each member needs a license for the Zoom products they want to reach. On a team marketplace an admin sets the credentials once for everyone; each member still completes their own Zoom OAuth login, so tool calls run with that member's Zoom permissions. ## Other Zoom MCP servers