# Cannot log in to same OAuth account from 2 devices using same Client ID

**URL:** <https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985>\
**Category:** API and Webhooks\
**Created:** [December 7, 2019, 11:32pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985 "2019-12-07T23:32:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Wulf](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/adam_wulf/32/1465_2.png) [@Adam\_Wulf](https://devforum.zoom.us/u/Adam_Wulf)\
**Post date:** [December 7, 2019, 11:32pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/1 "2019-12-07T23:32:25Z")

</div>

**Description/Error**  
My setup: I have an iOS app and Mac app. Both use Zoom OAuth to login and add/edit/delete meetings. Both use the same client ID.

When I login to Zoom on Mac, it seems to invalidate the tokens that i’ve stored on iOS. If i then re-login to iOS, the Mac’s tokens are invalidated.

Is each user only allowed a single OAuth access/refresh token per client ID, and each login invalidates any existing tokens?

**Which Endpoint/s?**  
Oauth login, meetings endpoints

**How To Reproduce (If applicable)**  
Steps to reproduce the behavior:

1. Login to Zoom with OAuth from my Mac app using my client ID
2. Can add/edit/delete meetings just fine on Mac
3. Login to Zoom with OAuth from my iOS app using same client ID
4. Can add/edit/delete meetings just fine on iOS
5. **Cannot** add/edit/delete meetings on Mac anymore, i get “Invalid Token”
6. Re-login to Zoom with OAuth on Mac
7. Can add/edit/delete meetings just fine on Mac
8. **Cannot** add/edit/delete meetings on iOS anymore, i get “Invalid Token”

**Additional context**  
Am I understanding correctly that any active access/refresh token is immediately invalidated when that same user logs into Zoom using OAuth using the same client ID that was originally used? Is it not possible for a user to have 2+ OAuth sessions on a client ID?

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [December 9, 2019, 9:20pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/2 "2019-12-09T21:20:56Z")

</div>

Hey @Adam_Wulf,

When you say OAuth do you mean installing / reauthorizing a [Zoom OAuth App](https://marketplace.zoom.us/docs/guides/getting-started/app-types/create-oauth-app) multiple times across your devices? If so, then yes each time you go to the install url, it will revoke any prior access and refresh tokens.

Can you please share your use case?

That being said, there does seem to be a bug or feature request here.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![Adam\_Wulf](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/adam_wulf/32/1465_2.png) [@Adam\_Wulf](https://devforum.zoom.us/u/Adam_Wulf)\
**Post date:** [December 9, 2019, 10:14pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/3 "2019-12-09T22:14:00Z")

</div>

Yes, i mean authorizing my app multiple times across 2+ apps using the same client ID.

my use case is a mac + iPad + iPhone app that uses zoom api to add/edit/list upcoming zoom meetings. I’m currently using the same zoom client ID across all 3 devices. when i authorize zoom on one of those devices, the other 2 devices log out.

My initial thought was to simply use multiple client IDs, and setup a mac client ID and an iOS client ID, but then i’d have the same problem for iPhone vs iPad. Those are shipped as the same iOS app, so if the user installs the app on their phone and also on their iPad, then the iPhone will logout the iPad, and vice-a-versa.

I’d like to be able to authorize a user on multiple devices, and have each device be independent of the others so that the user isn’t logged out on other devices when they add a new device.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [December 9, 2019, 11:31pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/4 "2019-12-09T23:31:03Z")

</div>

Hey @Adam_Wulf,

So basically you are using [Zoom OAuth](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom) as the primary authentication for your application? If so, Zoom OAuth was designed to “Connect” your Zoom account to an existing application, not to handle authentication for your app across all your devices.

The proper way to do this would be to handle authentication on your end, saving separate access\_tokens and refresh\_tokens for each device that logs in, or upon successful login send the existing access\_token to the new device to use. Then “Connect to Zoom” via [our OAuth](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom) to get a single reference access\_token and refresh\_token and save it in your users database along with **your** access\_token and refresh\_token records. That way on each authenticated device, their will be a single Zoom connection and that connection will be retained. Here is what a sample database would look like:

Users Table

| user\_id (primary key) | your\_access\_token | your\_refresh\_token | zoom\_access\_token | zoom\_refresh\_token |
| --- | --- | --- | --- | --- |
| 1 | asdfkljhfjksal | kasiwqe | 12fwfs3rg2r23.12ffasdf.fsadfas | oiwqe9832.asgpo0932 |
| 2 | qweruiowrquwioer | zxcvjkasd | zxcv909.zxvzcxvn23.21asdfasdf | mopqower123.mzqqe |
| 3 | zxcvzxcvzxcv | sadfjhvkjo | poaaskf9v00zxcv.214nsdafo.asfg | d0194.vnasoiewq.avjadu382 |

Here is the flow:

1. User logs in using your authentication method
2. Upon successful login, you use their `user_id` or their `your_access_token` to look up the `zoom_access_token` you have stored for that user.
3. Use the `zoom_access_token` to make requests to the [Zoom API](https://marketplace.zoom.us/docs/api-reference/introduction).

Let me know if that makes sense.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![Adam\_Wulf](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/adam_wulf/32/1465_2.png) [@Adam\_Wulf](https://devforum.zoom.us/u/Adam_Wulf)\
**Post date:** [December 10, 2019, 1:29am UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/5 "2019-12-10T01:29:36Z")

</div>

The only application I have is local to the iPhone/iPad/Mac. There’s no central database/web application/users table to attach zoom tokens to so that they could be shared across devices. I don’t have a primary authentication - instead the application works out of the box without any user login, and users can choose to optionally connect to additional services from any of their devices on a per-device basis. Those connections don’t sync across devices, and all api requests are initiated from the device itself.

By comparison, we also allow users to connect their Google accounts to sync down calendar appointments, and in that case the user logs into Google using OAuth separately on each of their devices, receiving different access/refresh tokens each time, and those logins act entirely separately. Device A’s tokens aren’t invalidated when logging in a 2nd time on device B.

There’s a few other OAuth providers we let users connect to from their devices, and in each case the access/refresh tokens aren’t invalidated on their other devices. Zoom appears to be the only provider we’ve integrated that invalidates all other tokens after each successful oauth login.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [December 10, 2019, 2:15am UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/6 "2019-12-10T02:15:09Z")

</div>

Hey @Adam_Wulf,

I see the issues here with local apps and no central database.

Unfortunately as of now Zoom’s OAuth does not support this use case. I will discuss adding this to the roadmap with our team.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![Adam\_Wulf](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/adam_wulf/32/1465_2.png) [@Adam\_Wulf](https://devforum.zoom.us/u/Adam_Wulf)\
**Post date:** [December 10, 2019, 9:16am UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/7 "2019-12-10T09:16:18Z")

</div>

Ok, Thanks Tommy for passing it on and for confirming that’s the intended behavior for now

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [December 10, 2019, 5:05pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/8 "2019-12-10T17:05:29Z")

</div>

You’re welcome! 🙂

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 7:07pm UTC](https://devforum.zoom.us/t/cannot-log-in-to-same-oauth-account-from-2-devices-using-same-client-id/6985/9 "2020-08-21T19:07:13Z")

</div>

Closed on August 21, 2020, 7:07pm UTC


