# Best practice for linking a Deauthorization webhook with an access token **URL:** \ **Category:** API and Webhooks\ **Tags:** api\ **Created:** [November 25, 2022, 11:33am UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321 "2022-11-25T11:33:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mark.walsh](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@mark.walsh](https://devforum.zoom.us/u/mark.walsh)\ **Post date:** [November 25, 2022, 11:33am UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/1 "2022-11-25T11:33:04Z")
### Format Your New Topic as Follows: [Zoom OAuth](https://marketplace.zoom.us/docs/guides/auth/oauth/) **Description** Currently; I am obtaining an access token, parsing the JWT to extract the account ID and storing that account ID with the access token. Once a deauth webhook is received; I find the access token via the account ID and remove it. This feels kind of dirty because I am using the access token itself which is undocumented and subject to change; is there another recommended method for linking a Deauthorization request with an access token? **Error?** N/A **How To Reproduce** N/A ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [November 28, 2022, 3:46am UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/2 "2022-11-28T03:46:36Z")
Hi > [@mark.walsh](#): > > I am obtaining an access token, parsing the JWT to extract the account ID and storing that account ID with the access token. Are you doing this process each time there is a new access token granted? > [@mark.walsh](#): > > Once a deauth webhook is received; I find the access token via the account ID and remove it. This feels kind of dirty because I am using the access token itself which is undocumented and subject to change What do you mean by “using the access token itself”? Like from when you initially obtain the access token like in the first part of your post? Ultimately, the account id is the main identifier in the deauth notification webhook and then you use that to isolate the access token which it sounds like you are doing. I do understand the push for more official guidance on this though. Before I continue, please confirm my present understanding 🙂 ---
**Author:** ![mark.walsh](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@mark.walsh](https://devforum.zoom.us/u/mark.walsh)\ **Post date:** [November 28, 2022, 10:39am UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/3 "2022-11-28T10:39:27Z")
> What do you mean by “using the access token itself”? Like from when you initially obtain the access token like in the first part of your post? Many thanks for your response; **Yes** ; so when I initially obtain an access token; I parse it to retrieve the account ID and store it. I then use this to identify which access token to delete when a deauth webhook is received. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [November 28, 2022, 10:18pm UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/4 "2022-11-28T22:18:38Z")
@mark.walsh , I’m going to check in with some of our app marketplace specialists to see if there’s any updated guidance I can offer you! ---
**Author:** ![mark.walsh](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@mark.walsh](https://devforum.zoom.us/u/mark.walsh)\ **Post date:** [December 16, 2022, 1:36pm UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/5 "2022-12-16T13:36:18Z")
Hey thanks for this; any word on this? ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [January 28, 2023, 12:28am UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/6 "2023-01-28T00:28:46Z")
Hi @mark.walsh , Apologies for missing this! There is no updated guidance on this yet, but this is an area for clearer documentation. Thank you for bringing that to our attention. Your approach seems okay so far and Zoom will alert if and when there is a change to this. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [January 31, 2024, 4:05pm UTC](https://devforum.zoom.us/t/best-practice-for-linking-a-deauthorization-webhook-with-an-access-token/79321/8 "2024-01-31T16:05:32Z")
Closed on January 31, 2024, 4:05pm UTC This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.