# Cannot use secret\_token to validate deauthorization event

**URL:** <https://devforum.zoom.us/t/cannot-use-secret-token-to-validate-deauthorization-event/78525>\
**Category:** Authentication\
**Tags:** webhooks\
**Created:** [November 9, 2022, 9:43am UTC](https://devforum.zoom.us/t/cannot-use-secret-token-to-validate-deauthorization-event/78525 "2022-11-09T09:43:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leexi](https://avatars.discourse-cdn.com/v4/letter/l/c89c15/32.png) [@leexi](https://devforum.zoom.us/u/leexi)\
**Post date:** [November 9, 2022, 9:43am UTC](https://devforum.zoom.us/t/cannot-use-secret-token-to-validate-deauthorization-event/78525/1 "2022-11-09T09:43:56Z")

</div>

It seems it’s currently only possible to verify the deauthorization event using the verification\_token, and not the secret\_token. This is despite the verification\_token being [planned for deprecation in October 2023.](https://marketplace.zoom.us/docs/guides/auth/deauthorization/#security-validation)

Am I missing something? Could you add the `x-zm-request-timestamp` and `x-zm-signature` to the deauthorization event headers so that it can be [verified using the secret\_token](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#verify-webhook-events), like all other events?

Currently I get the following deauthorization event

```auto
POST /webhooks/conferencing/zoom/deauthorize HTTP/1.1
Host: XXXXX
User-Agent: zoom-marketplace/1.0
Content-Length: 303
Accept: */*
Accept-Encoding: gzip
Authorization: XXXX
Clientid: XXXX
Content-Type: application/json;charset=UTF-8
X-Forwarded-For: 134.224.191.1
X-Forwarded-Proto: https

{"event":"app_deauthorized","event_ts":1667985308769,"payload":{"account_id":"XXXX","user_id":"XXX","signature":"deb4da910bdb3f0e55515f3ed722f945cb07b59e60e3122b2b04d4f6349561ae","deauthorization_time":"2022-11-09T09:15:08.769Z","client_id":"XXXX"}}
```

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [January 10, 2023, 9:51pm UTC](https://devforum.zoom.us/t/cannot-use-secret-token-to-validate-deauthorization-event/78525/3 "2023-01-10T21:51:07Z")

</div>

Hi @leexi  
Thanks for reaching out to the Zoom Developer Forum, I am happy to help here!  
Have you been able to fix this issue or do you still need assistance from us?  
Let me know 🙂  
Best.  
Elisa

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [June 12, 2023, 2:30pm UTC](https://devforum.zoom.us/t/cannot-use-secret-token-to-validate-deauthorization-event/78525/5 "2023-06-12T14:30:38Z")

</div>

Closed on June 12, 2023, 2:30pm UTC