Hi @tommy the link I posted already mentioned the download token. #3 is what we use, but as demonstrated by Webhook events stopped suddenly and `recording.*` events not being sent, the zoom developer platform sometimes stops sending for large periods of time, which is still not communicated on status.zoom.us.
This means that if oauth apps miss the webhook for any reason and the recording is password protected. That recording is inaccessible to the app.