**Note** from Bead: Zoom Manager · [canonical source](https://redfish.acequia.io/guerin/.agents/ecb7687f-614b-4d5a-baca-290065a5875d/2026-06-18/notes/00-zoom-manager.md) · session 2026-06-18 · discussion: Talk: Zoom Manager
## Stephen's frame (verbatim intent) - `bead-start zoom-manager` - use zoom api key - manage recordings - sync recordings to acequia - skill `create-bead-from-zoom-call` - **first task:** instruct the Claude Chrome extension to get the key with ambient authority ("I'm logged in").
## The four jobs 1. **Credential access** — obtain Zoom API credentials. See `01-ce-get-zoom-key.md`. 2. **Manage recordings** — list / filter / fetch cloud recordings via the Zoom API. 3. **Sync to acequia** — land media + metadata on a WebDAV origin (home TBD; candidate `redfish.acequia.io/guerin/recordings/` or a per-incident/per-project home). 4. **`create-bead-from-zoom-call` skill** — one recording -> one bead: transcript (Zoom VTT) into `chats/` or `artifacts/`, media into `artifacts/`, distilled summary into `notes/`.
## Credential-type reality (important) Zoom retired JWT apps (the old "API Key + API Secret") in 2023. The current path for **automated, user-unattended recording management** is a **Server-to-Server OAuth** app, which issues: - **Account ID** - **Client ID** - **Client Secret** A short-lived bearer access token is then minted at `POST https://zoom.us/oauth/token?grant_type=account_credentials&account_id=<ACCOUNT_ID>` with HTTP Basic auth `client_id:client_secret`. That token calls the REST API, e.g. `GET https://api.zoom.us/v2/users/me/recordings`. So "the key" = the **Server-to-Server OAuth credential triple**, not a single string.
## Credential placement (non-negotiable) The secret lands in a **node**, not the commons: `c:\Users\steph\Documents\sites\.credentials\api-keys\zoom.json` and a manifest entry in `.credentials\manifest.json`. It is **never** written into this bead's GUID tree and **never** synced. (Per browser-is-a-parciante-node / bead-as-webdav-handler: credentials live in nodes; placement = scope x blast-radius x revocability.)
## Open questions for Stephen 1. Does a Zoom app already exist in this account, or should the CE create a fresh Server-to-Server OAuth app (proposed name `acequia-zoom-manager`)? 2. Scope set: read-only (`cloud_recording:read:...:admin`) vs read+write (also delete/ manage)? Default proposal: **read-only** first. 3. Sync home + retention: where do recordings land, and do we delete from Zoom cloud after a verified sync (apoptosis) or leave them? 4. Account type: is this a Zoom account where you are **admin** (needed for `...:admin` scopes / account-level recordings) vs a single-user account?