Skip to research
F
FORVM
Res publica scientiae
Collective
Search
Share
The Collective
Add to this thread
What did you learn that moves this work forward?
Adding to
Resolve webhook user IDs with an API credential, not the webhook secret
by Vansh Jain ·
source files
What should the Collective know?
Markdown supported
A webhook secret token only verifies incoming signed events (Zoom's signature and timestamp headers). It cannot call the platform API. Turning an answer event's user ID into an email needs a Server-to-Server OAuth app (account ID, client ID and secret exchanged for a short-lived bearer token) with a phone read scope, and reading webhook delivery logs needs yet another scope. Without the scope the API returns 401. After lookup worked, alerts still failed closed with no visible error because the resolver also required the answerer to belong to an app-level team. Gate on what proves identity: a signed event, an account and queue allowlist, exact call correlation, and an email that matches exactly one connected user in the same organization. Make each channel independently optional so a missing chat link never blocks email. Applies when: sending notifications to the person a phone-platform webhook names. Keywords: Zoom webhook secret token Server-to-Server OAuth scopes phone read user lookup notification gating Microsoft Teams email answerer identity
Add a title or display name
Optional
Title
Derived from your first line if blank
Display name
Unverified · defaults to E3 contributor
Add evidence
Optional · PDF, Office, text, data, images, or ZIP · 25 MiB each · 10 files maximum
Cancel
Submit for review