# Can't I set refresh token in URL query parameters?

**URL:** <https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621>\
**Category:** Authentication\
**Tags:** api\
**Created:** [February 6, 2023, 5:21am UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621 "2023-02-06T05:21:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanata.koyama](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kanata.koyama/32/45206_2.png) [@kanata.koyama](https://devforum.zoom.us/u/kanata.koyama)\
**Post date:** [February 6, 2023, 5:21am UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621/1 "2023-02-06T05:21:58Z")

</div>

**API Endpoint(s) and/or Zoom API Event(s)**  
_Link the API endpoint(s) and/orZoom API Event(s) you’re working with to help give context._

[https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token](https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token)

this is my api call

- api endpoint: /oauth/token?grant\_type=refresh\_token&refresh\_token=${refreshToken}`
- method: POST
- header: ‘Authorization’: ‘Basic ${base64 encoded from zoom app client id & client secret }’

**Description**  
_Details on your question, workflow or the problem you’re trying to solve._  
I review my codes of zoom api call, because I got email about Zoom API Security Update. It says;

> As a part of our continuing efforts to improve the security of Zoom OAuth App Types using Authorization flow, we are removing the ability to set **the access tokens, refresh tokens and revoke tokens** in the URL query parameters.

but [this article](https://devsupport.zoom.us/hc/en-us/articles/12363164278669-API-access-token-change) says;

> **What happens if I fail to update my code?**  
> Beginning February 14, 2023, any API request that is sent with **the access token** in the URL query parameters will fail.

My api call has **refresh token** in query parameters. Must I update api call? and if yes, how to update?

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [February 9, 2023, 9:26pm UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621/2 "2023-02-09T21:26:54Z")

</div>

Hi @kanata.koyama  
Yes, you will need to update your call. This change will take effect on access\_tokens, refresh\_tokens and revoke\_tokens.

Here is a link to our Docs that has examples on how to change this workflow:  
[https://marketplace.zoom.us/docs/guides/stay-up-to-date/announcements/#send-access\_token-in-authorization-header-not-as-query-parameter](https://marketplace.zoom.us/docs/guides/stay-up-to-date/announcements/#send-access_token-in-authorization-header-not-as-query-parameter)

Hope this helps,  
Elisa

---

<div class="post-metadata">

**Author:** ![kanata.koyama](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kanata.koyama/32/45206_2.png) [@kanata.koyama](https://devforum.zoom.us/u/kanata.koyama)\
**Post date:** [February 11, 2023, 2:35pm UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621/3 "2023-02-11T14:35:33Z")

</div>

hi @elisa.zoom  
thank you for reply! i tried our new api call with reference to [this](https://marketplace.zoom.us/docs/guides/stay-up-to-date/announcements/#send-access_token-in-authorization-header-not-as-query-parameter) but finally got **an `unsupported_grant_type` error** … (same error as [this](https://devforum.zoom.us/t/oauth-app-unsupported-grant-type/79688))  
Here is our api call 👇

```auto
POST https://zoom.us/oauth/token

# Header
Authorization: Basic ${base64 encoded from zoom app client id & client secret }
Content-Type: application/x-www-form-urlencoded

# Request body
refresh_token: ${refreshToken}
grant_type: refresh_token

```

How can we fix it? or isn’t the new api call available yet?

---

<div class="post-metadata">

**Author:** ![kanata.koyama](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kanata.koyama/32/45206_2.png) [@kanata.koyama](https://devforum.zoom.us/u/kanata.koyama)\
**Post date:** [February 13, 2023, 2:57am UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621/4 "2023-02-13T02:57:02Z")

</div>

ah sorry, Our api call for application/x-www-form-urlencoded was wrong formatted…  
We fixed it! thanks!

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [February 13, 2023, 4:45pm UTC](https://devforum.zoom.us/t/cant-i-set-refresh-token-in-url-query-parameters/82621/5 "2023-02-13T16:45:23Z")

</div>

Good news! @kanata.koyama