Grok Bot Zoom plugin OAuth hardcodes http://localhost:8787/callback — Zoom rejects hostname localhost (error 4700)

Support Bug Reports
, , ,
1

Where does the bug appear (feature/product)?

Grok Bot

Describe the Bug

When connecting the catalog Zoom plugin from Grok Bot, OAuth always starts with redirect_uri=http://localhost:8787/callback. Zoom rejects the hostname localhost with error 4700 (Invalid redirect / « Redirection non valide ») and Zoom Marketplace will not even let you add localhost to the OAuth allow list (« localhost is not allowed »; Zoom only accepts http://127.0.0.1 or http://[::1] for loopback, or HTTPS otherwise).

Grok Bot has no parameter to change the redirect URI. Recreating the Zoom Marketplace app does not help: Cursor still sends localhost.

Cursor docs already document a working HTTPS callback for Web and Cursor Agents: https://www.cursor.com/agents/mcp/oauth/callback
That URL is accepted by Zoom (authorize returns the Zoom login/consent page). Grok Bot is an agent surface but still behaves like the desktop app and forces localhost.

Please make Grok Bot send https://www.cursor.com/agents/mcp/oauth/callback (preferred) or http://127.0.0.1:8787/callback instead of http://localhost:8787/callback.

Steps to Reproduce

  1. Install the catalog Zoom plugin in Grok Bot.
  2. Register a Zoom General OAuth app. Zoom refuses to add http://localhost:8787/callback. Add https://www.cursor.com/agents/mcp/oauth/callback and http://127.0.0.1:8787/callback.
  3. Click the Grok Bot Zoom connect/auth card.
  4. Browser opens Zoom authorize with redirect_uri=http://localhost:8787/callback.
  5. Zoom shows error 4700. The flow never completes. Plugin stays needsAuth with 0 tools.

Expected Behavior

Grok Bot should send a redirect_uri Zoom can accept: https://www.cursor.com/agents/mcp/oauth/callback (already documented for agents) or http://127.0.0.1:8787/callback (RFC 8252 loopback). Connecting the Zoom catalog plugin from Grok Bot should complete OAuth.

Operating System

MacOS

Version Information

Grok Bot desktop app on macOS (MacBook Pro) — exact version string unavailable (privacy mode; About info not accessible at time of report).

Additional Information

  • Operating system: macOS (MacBook Pro), Grok Bot desktop app.
  • Cursor docs (https://cursor.com/docs/mcp): Web and Cursor Agents use https://www.cursor.com/agents/mcp/oauth/callback ; Desktop uses http://localhost:8787/callback.
  • Live probes: Zoom authorize with localhost → 4700. Same client with 127.0.0.1 (public/PKCE) → login HTML. Same client with the HTTPS agents callback → login HTML.
  • Official Zoom plugin README still tells admins to register Desktop http://localhost:8787/callback, which current Zoom policy rejects.
  • In-app Grok Bot Send Feedback is unavailable in privacy mode, so this is posted on the forum instead.

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the detailed report with probes, it really helps.

You diagnosed it correctly. Sign-in for the Zoom plugin currently uses http://localhost:8787/callback as the redirect address, and Zoom no longer accepts the localhost hostname for OAuth redirects, which is why you’re seeing error 4700. The redirect isn’t configurable in the app, so there’s no workaround on your side right now. It’s not an issue with your setup.

We’re already tracking this, and I’ve shared your report with the team. Switching to a redirect that Zoom accepts, like the 127.0.0.1 option you suggested, is exactly what we’re looking at.

I can’t share an exact timeline yet, but I’ll post an update here when I have one.

7

Anything yet??? I really need this fixed.

9

Hey, there’s no update yet. The issue is on our radar, but I can’t share an exact timeline.

In short: sign-in for the Zoom plugin currently uses http://localhost:8787/callback as the redirect, and Zoom no longer accepts the localhost hostname, which causes error 4700. The redirect isn’t configurable in the app, so there’s no workaround on your side right now. This isn’t something in your setup. Switching to a redirect Zoom accepts, like 127.0.0.1, is the direction we’re looking at.

As soon as I have something to share, I’ll reply right here in the thread.

10

Also having the same issue. Let me know when it’s fixed. Has anybody found a workaround here?

11

Hey, yeah, this is the same issue described in the thread above. Sign-in for the Zoom plugin currently uses http://localhost:8787/callback as the redirect, and Zoom no longer accepts the localhost hostname for OAuth redirects, which causes error 4700.

Unfortunately, there’s no workaround on your side. The redirect isn’t configurable in the app, so you can’t fix it via Zoom app settings. This isn’t anything in your setup.

We’re aware of the issue. Switching to a redirect that Zoom accepts, like 127.0.0.1, is the direction we’re looking at. I can’t share an exact timeline yet, but as soon as there’s an update I’ll reply here in the thread.

12

SAME RECURRING BUG HERE:
Zoom connector OAuth fails with Invalid redirect: http://localhost:8787/callback (error 4,700). The Grok Bot Zoom connect flow hardcodes redirect and Zoom rejects the localhost hostname. This matches the known Cursor forum report (Grok Bot Zoom plugin OAuth hardcodes). Please fix the Zoom auth redirect to something Zoom accepts (e.g. Cursor Agent - Turn your ideas into code ) so the Zoom catalog plugin can complete OAuth from Grok Bot. Until then Zoom stays needsAuth and we cannot connect it.