Question
People commonly ask on the Zoom Developer Forum:
Why can’t I add certain scopes (like cloud_recording:read:list_recording_files and cloud_recording:read:list_recording_files:admin) to a Server-to-Server (S2S) OAuth app?
We want to call the Get Meeting Recordings endpoint (GET /meetings/{meetingId}/recordings) from an account-level S2S app that we don’t intend to publish. However:
-
In the S2S app type, these scopes aren’t available.
-
If we create a General app, the scopes are available — but that type is intended for publishing to the Zoom App Marketplace, which we don’t want to do.
-
When calling the API with the S2S app, we get:
{
"code": 4711,
"message": "Invalid access token, does not contain scopes:[cloud_recording:read:list_recording_files, cloud_recording:read:list_recording_files:admin]."
}
Answer
Some Zoom API scopes are tied to specific app types. The cloud_recording scopes needed for the recordings API are not available to Server-to-Server OAuth apps. They are only supported in General apps.
If you need those scopes but don’t want your app to be public:
-
You can create a General app and request the scopes you need.
-
When submitting, set the app to “Unlisted”.
- Unlisted apps go through Zoom’s approval process but will not be published in the public Marketplace.
- This lets you use the required scopes privately, without exposing your app to external users.
tldr; If your integration requires cloud_recording scopes, you’ll need to use a General app, not an S2S app. Setting it as Unlisted keeps it private while unlocking the scopes you need.
Zoom Developer Forum Examples
Some examples of this question are:
