# Zetapad developer documentation

> Build hosted iframe apps for Zetapad. Use the version 2 iframe protocol and required server-side REST authentication for every app.

Production parent origins: https://zetapad.com and https://www.zetapad.com. REST API origin: https://zetapad.com.

Apps are confidential clients: keep client secrets and access tokens on your backend. No JavaScript SDK or refresh tokens are provided.

Iframe protocol version 2 supports ready and authenticate. Authenticate returns only code, expiresIn, and state. Complete the backend code exchange before starting the app.

Backend userinfo includes userId, Zetapad's server-generated primary member ID shared across apps, and scopes, even with no scopes. userId is not a Firebase UID. Resolve identity from the verified server session before accessing saved member data. The ID may be returned to the UI after login; it is not a credential.

With approved profile:read access, userinfo also returns username, a unique lowercase handle the member can change anytime. Use username for display and the permanent userId for saved data; released usernames can belong to another account.

Apps can use campus calls through scoped REST endpoints and Zetapad-hosted iframe tiles. Register calls:read, add calls:control for actions, and complete backend login. GET /v1/apps/calls/status silently reports minimal accepted-call availability in the owning tab before per-call approval; it creates no grant or prompt. Attach and obtain native approval before roster or tiles. Each member can present up to six speaker tiles or use audio-only while Zetapad retains audio, capture, and recovery.

## Start here

- [Introduction](https://zetapad.com/developers/docs/index.md): Build a hosted app, launch it as a Zetapad room, and connect to members with their permission.
- [Quickstart](https://zetapad.com/developers/docs/quickstart.md): Register your app, complete the iframe handshake, and authenticate your first member.

## Guides

- [Iframe embedding](https://zetapad.com/developers/docs/embedding.md): Configure your launch URL, embedding headers, and local development environment.
- [Authentication and permissions](https://zetapad.com/developers/docs/authentication.md): Understand member consent, server-side login, profile permissions, and credential expiry.
- [Restrict app access](https://zetapad.com/developers/docs/access-control.md): Block direct browser launches and protect your app's data and actions with verified Zetapad access.
- [Publishing and app lifecycle](https://zetapad.com/developers/docs/publishing.md): Preview, publish, update, rotate credentials, and delete your registered app.
- [Campus calls in apps](https://zetapad.com/developers/docs/calls.md): Use REST and hosted video tiles to share an existing campus call and invite members into app activities.

## Reference

- [Iframe protocol](https://zetapad.com/developers/docs/protocol.md): The version 2 postMessage contract for readiness and code-only authorization.
- [REST API](https://zetapad.com/developers/docs/api-reference.md): Exchange an authorization code and fetch the member fields approved for your app.
- [Errors and troubleshooting](https://zetapad.com/developers/docs/troubleshooting.md): Recover from iframe, authentication, credential, and embedding failures.

## Examples

- [Hosted call example](https://zetapad.com/developers/docs/examples/calls.md): A backend REST integration and plain iframe layout with no calls SDK.
- [Browser example](https://zetapad.com/developers/docs/examples/browser.md): A raw JavaScript integration that verifies the parent, authenticates, and starts your app.
- [Server example](https://zetapad.com/developers/docs/examples/server.md): Node.js handlers for session-bound state, confidential token exchange, and protected member reads.

## Machine-readable references

- [All documentation](https://zetapad.com/llms-full.txt): Complete Markdown with integration examples.
- [OpenAPI](https://zetapad.com/developers/docs/openapi.json): REST endpoint schemas and authentication.
- [Iframe JSON Schema](https://zetapad.com/developers/docs/protocol.schema.json): Version 2 request and response shapes.