Add Scopes to Legacy OAuth App

API and Webhooks Authentication
1

API Endpoint(s) and/or Zoom API Event(s)
Zoom OAuth Scopes

Description
We have an existing legacy OAuth app and would like to add additional scopes. While reviewing the documentation, we saw that existing customers would need to reauthorize the app within 90 days after new required scopes are added.

We have a few questions:

  1. Is there any way to avoid requiring existing customers to reauthorize when new scopes are added?

  2. If we add new scopes over time, will customers need to reauthorize each time additional scopes are introduced?

  3. Since this is a legacy OAuth app, we’re also considering migrating to a new OAuth app so we can take utilize optional scopes. What does that migration process typically look like? Is there a recommended path for moving existing installations to a new app with minimal customer disruption?

We’re trying to determine the best long-term strategy for evolving our app’s permissions while minimizing the impact on our customers. Is reauth necessary only if the customer needs the new scope, or anytime we make changes to our app?

Error?
N/A

How To Reproduce
N/A

Referenced Docs: Updating an App - Distribute - Zoom Developer Docs

2

hi @amp23 ,

  1. Users MUST approve New scopes. You need their permission. to take access to new informaiton

  2. Users must approve a new scope whenever you release it. So I would suggest you consider releasing multiple scopes at the same time.
    Remember you can have options scopes so they could then choose to not allow those if you want the option to keep as is.

  3. You build your replacement version, submit to marketplace for approval and then you can go live and users then approve the new scopes.

Note that your software will fail on scopes before they are approved.

I hope that helps

John Drinkwater
Zoom Developer Champion
Not a Zoom Employee

3

Thanks for the clarification! Just to make sure I understand correctly:

If an existing customer has already authorized the app with the current scopes, but never uses the new functionality that requires the additional scopes, will they still need to reauthenticate within the 90-day window? Or is reauthentication only required if they want to use the new features that depend on the new scopes?

The new scopes are used in a completely different area of our application, so we’re trying to avoid disrupting existing customers who don’t need that functionality, but who are using existing scopes.

We’re trying to understand the customer impact so we can plan our rollout and customer communication appropriately.

Thanks! We appreciate your help! :grinning_face:

4

@expertswho - wondering if you can please take a look?

5

HI @amp23 ,

I would love you to join our developers’ office hours, and we could go into this because the whole story is getting more complicated - and yet easier. It’s also likely that someone from the marketplace team will be around to contribute.

You see, I have been giving feedback to the Zoom Marketplace team, who are rolling out an amazing upgraded marketplace system over time. As such, I have had to keep things to myself until I felt confident enough to describe what is happening and what I am allowed to say.

This matters now, because it opens new possibilities.

Zoom Marketplace is evolving. There are so many ways to develop with Zoom now; they need a platform to cover all systems.

One of the big changes coming is version control.

So let’s apply this to adding new scopes.

If you add new scopes, you can make them mandatory or optional, and customers can approve them, but they would have to make an approval, even if it was to not approve the optional (which could be your new scopes)

Zoom is now working on version control, so you could have multiple versions of the same app. On these different versions, you could keep the ones you didn’t want to approve on an older version of your app.

Either way, one rule stays.
If you want to access new scopes on an app. It MUST be approved by the tenant account holder for all their users, or by each user in turn.
You must get user approval when you add new scopes and therefore access to new information about the user within Zoom.

I hope that takes you forward. But I think the roadblock will still be that they will need to approve the scopes at some point and will not be able to use them until they do.

I would ignore the 90-day rule; that is more to do with expiring keys.

I hope that takes you a little further forward.

all the best

John

6

Thanks, John! We appreciate the context and would love to join office hours! We’ll sign up for next week. We hope to see you there!