webhooksSecretToken not necessary for scripts - should be optional?

[nktnet1]

For example, this is the code I'm currently using:

/**
 * ./src/main.tsx
 */

import "dotenv/config";
import { PhoneS2SAuthClient } from "@zoom/rivet/phone";
import * as v from "valibot";

const envSchema = v.object({
  ZOOM_ACCOUNT_ID: v.pipe(v.string(), v.minLength(1)),
  ZOOM_CLIENT_ID: v.pipe(v.string(), v.minLength(1)),
  ZOOM_CLIENT_SECRET: v.pipe(v.string(), v.minLength(1)),
});

const env = v.parse(envSchema, process.env);

const main = async () => {
  const client = new PhoneS2SAuthClient({
    clientId: env.ZOOM_CLIENT_ID,
    clientSecret: env.ZOOM_CLIENT_SECRET,
    accountId: env.ZOOM_ACCOUNT_ID,

    // This could be an optional field instead?
    webhooksSecretToken: "unused",
  });

  try {
    const results = await client.endpoints.callLogs.getUsersCallHistory({
      path: {
        userId: "<REPLACE_WITH_SOME_ZOOM_USER_ID>",
      },
      query: {
        recording_status: "recorded",
        page_size: 1,
      },
    });

    if (!results.data?.call_logs) {
      return null;      
    }

    const res = results.data.call_logs?.map((cl) => {
      return {
        id: cl.id,
        callId: cl.call_id,
        callerName: cl.caller_name,
        recordingType: cl.recording_type,
      };
    });

    console.log(JSON.stringify(res, null, 2));
  } catch (error) {
    console.error("Error:", error);
  }
};

if (import.meta.url === `file://${process.argv[1]}`) {
  void main();
}

It's just a one-off basic script, e.g. run with:

pnpx tsx src/main.tsx

I think having a basic example of this in the docs is also helpful - I couldn't figure out if an actual server was needed to run simple scripts.

---

That aside, really appreciate that this underrated library exists, with all the typings & convenient features baked in. Thank you.

[jcoon97]

Hey, @nktnet1!

The receiver/server is not necessary to execute a simple script, assuming that the script is only calling APIs and not ingesting any webhooks from Zoom.

In those cases, the client (in your case, PhoneS2SAuthClient) has an option disableReceiver. If this is set to true, the webhook receiver is not instantiated or started, which will allow you to just call APIs without the need for running a server.

An example of this configuration would be as follows:

const phoneClient = new PhoneS2SAuthClient({
  clientId: "[YOUR_S2S_CLIENT_ID]",
  clientSecret: "[YOUR_S2S_CLIENT_SECRET]",
  accountId: "[YOUR_S2S_ACCOUNT_ID]",

  // If disableReceiver is set to true, webhooksSecretToken is
  // no longer required or read when client instantiates.
  disableReceiver: true
});

I hope this helps! Please let us know if you have any further questions!

[nktnet1]

Thanks @jcoon97 - out of curiousity, I wonder why the receiver is not disabled by default, and automatically enabled when the webhook token is specified. Are there use cases that I'm not accounting for?

Regardless, this will suffice for our application, so I'll close the issue. Thank you!

[nktnet1]

Hey @jcoon97,

I ran into the type issue again when the tokenStore is specified - here's the minimal reproducible example:

export const createPhoneClient = () => {
  return new PhoneS2SAuthClient({
    clientId: env.ZOOM_CLIENT_ID,
    clientSecret: env.ZOOM_CLIENT_SECRET,
    accountId: env.ZOOM_ACCOUNT_ID,
    disableReceiver: true,
    tokenStore: {
      getLatestToken: () => {
        return null;
      },
      storeToken: (token) => {
        console.log({ token });
      },
    },
  });
};

Have to once again replace disableReceiver: true with webhooksSecretToken: "unused"

[jcoon97]

Hey, @nktnet1. I've created an internal ticket for this, and a fix should be present in the next release!

[nktnet1]

Confirm that this has been resolved in #6 as of version 0.3.0:

• https://developers.zoom.us/changelog/rivet/javascript/0.3.0

🚀

---

As an aside, if we forget to specify disableReceiver: true, the following error is shown:

Error [ProductClientConstructionError]: Options must include a custom receiver, or a webhooks secret token.

Perhaps useful if the error message could mention the disableReceiver option, or potentially have it disabled by default if neither the webhooksSecretToken nor receiver is provided.

---

Just a suggestion, but overall happy with the changes and current state. Thank you!