Documentation

1. Installing the app

You can install PublishFlow from two places:

• Zoom App Marketplace: visit the PublishFlow listing on marketplace.zoom.us and click Add. You will be redirected to authorize PublishFlow with your Zoom account.
• Direct sign-up: visit publishflow.intersomos.com.br and click Go to Dashboard. You will be redirected to Zoom to sign in.

Both flows start with the same Zoom OAuth consent screen. After you approve the requested permissions (see Scopes and permissions), you will be redirected to your PublishFlow dashboard.

2. Connecting your Zoom account

1. From the home page, click Go to Dashboard.
2. You are redirected to Zoom's OAuth consent screen.
3. Review the requested scopes (see section 11) and click Allow.
4. You are redirected back to PublishFlow and signed in. Your Zoom card on the dashboard shows Active with your email.

3. Connecting your YouTube channel

1. From the dashboard, find the YouTube card (red banner) and click Connect.
2. You are redirected to Google's OAuth consent screen.
3. Choose the Google account that owns the YouTube channel you want to publish to.
4. Review the requested scopes (YouTube upload and read access) and click Continue.
5. You are redirected back to PublishFlow. The YouTube card now shows Active and your playlists are loaded.

PublishFlow uses Google's standard offline access flow, which means we receive a refresh token to upload videos on your behalf without you being present. You can revoke this access at any time from your Google account's Security settings.

4. Linking meetings to playlists

Once both Zoom and YouTube are connected, the Meeting → Playlist Links section appears on the dashboard. Here you can pair each recurring Zoom meeting with a specific YouTube playlist.

1. Find the meeting in the unlinked list.
2. Click + Link to playlist on the right side.
3. Pick the destination playlist from the dropdown.
4. Click the ✓ button to save the link.

From that moment on, any cloud recording for that meeting is automatically published to the paired playlist. If a meeting is not linked, the recording will be uploaded to your default playlist (set under Settings) or to your channel without a playlist if no default is set.

To remove a link, click the trash icon next to it. The link is removed immediately; future recordings will follow your default settings.

5. How recordings are published

The workflow is fully event-driven. Here is the exact sequence when you finish a Zoom meeting:

1. You end a Zoom meeting that was recording to the cloud.
2. Zoom processes the recording (usually 5 to 15 minutes depending on duration).
3. Zoom fires a recording.completed webhook to PublishFlow.
4. PublishFlow verifies the webhook signature using HMAC-SHA256.
5. If you have Auto-publish enabled (default), a background job is queued.
6. The worker downloads the MP4 from Zoom using the temporary access token Zoom provides.
7. PublishFlow generates structured metadata: title (e.g. #1 Q4 Sales Review), description with host name and duration.
8. The video is uploaded to YouTube using the resumable upload protocol.
9. The video is added to the linked playlist (or default playlist).
10. The MP4 file is deleted from PublishFlow servers (it was only used to transfer the file).
11. You receive an email notification with the YouTube link.

The default privacy of the published video is whatever you set under Settings → Default Privacy (private, unlisted, or public).

6. Managing recordings

All your processed recordings appear in two places:

• Dashboard → Recent Recordings: grouped by YouTube playlist, expandable accordion.
• Recordings page: full table with filters (All, Queued, Processing, Published, Failed).

For each recording you can:

• Click the external link icon to open the video on YouTube.
• Click + Add to playlist or Change playlist to move it to a different YouTube playlist (calls the YouTube Data API).
• Click Retry on a failed recording to re-queue it for processing.

7. Settings and preferences

Under Settings in the navigation, you can configure:

• Default privacy: private, unlisted, or public. Applied to every new upload.
• Default playlist: fallback playlist used when a recording's meeting is not explicitly linked.
• Title prefix: short string prepended to every title (e.g. #, PF).
• Auto-publish: if disabled, recordings are saved to the dashboard but not uploaded automatically. You must trigger the upload manually.
• Notify on publish: email when a recording goes live.
• Notify on failure: email when a recording fails.

8. Email notifications

PublishFlow sends transactional emails for two events:

• Recording published: includes the meeting title, the YouTube link, and the playlist it was added to.
• Recording failed: includes the error summary and a link to retry from the dashboard.

Both notifications can be turned off individually under Settings. Emails are sent via Resend (SMTP, TLS 465).

9. Removing the integration

Disconnect Zoom or YouTube individually

From the dashboard, click Disconnect on either the Zoom or YouTube card. This removes that integration's OAuth tokens from our database. The other integration and your recording history remain intact.

Deauthorize the entire app from Zoom Marketplace

1. Sign in to Zoom App Marketplace.
2. Go to Manage → Installed Apps.
3. Find PublishFlow and click Remove.
4. Zoom sends an app_deauthorized webhook to PublishFlow.
5. PublishFlow deletes all your data (OAuth tokens, recordings, settings, account) from PostgreSQL.
6. PublishFlow notifies the Zoom Data Compliance API that the deletion is complete.

Revoke YouTube access

Visit myaccount.google.com/permissions, find PublishFlow, and click Remove access. This invalidates the YouTube refresh token immediately.

10. Deleting your account

1. Go to Settings.
2. Scroll to the Account section.
3. Click Delete account and confirm.
4. All your data (OAuth tokens, recordings, settings, account row) is permanently deleted from PostgreSQL within seconds.
5. You are signed out and redirected to the home page.

Before deleting, you can Export your data from the same Settings page. You will receive a JSON file containing your account info, recording history, and connection details.

11. Scopes and permissions

PublishFlow requests these Zoom scopes during sign-in:

PublishFlow also subscribes to two webhook events: recording.completed and recording.deleted, plus the standard deauthorization webhook required by Zoom.

12. Security and privacy

• OAuth-only authentication. We never see or store your Zoom or Google passwords.
• AES-256-GCM encryption. All OAuth tokens are encrypted at rest in PostgreSQL using a master key stored only in the production environment.
• HMAC-SHA256 verification. Every Zoom webhook is cryptographically verified against the per-app secret token. Requests with invalid signatures are rejected with HTTP 401.
• TLS 1.2+. Enforced at the Caddy reverse proxy. HSTS preload, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers are set on every response.
• No video storage. Recordings are streamed to ephemeral container storage, uploaded to YouTube, and immediately deleted. They are never persisted to disk, object storage, or any database.
• Full data compliance. When you deauthorize the app, all your data is deleted and Zoom is notified via the Data Compliance API.

13. Troubleshooting

14. Frequently asked questions