Discrepancy between Zoom usage via Zoom Workplace and Zoom API usage via OAuth applications

API and Webhooks
,
1

■Premise
As a constraint of the Zoom API, refresh tokens have an expiration period.

＜Zoom API Constraints＞
・The refresh token used when calling the Zoom API expires 90 days after last use.
Once this period is exceeded, the user cannot use the Zoom API. (Re-authentication with the OAuth app is required.)
（https://developers.zoom.us/docs/integrations/oauth/）

Even if Zoom features (such as creating or hosting meetings) are used directly from Zoom Workplace without utilizing the Zoom API, the Zoom API becomes unavailable after 90 days if there is no Zoom API usage via the OAuth app. We have received multiple comments from users of our SaaS system stating that the discrepancy between their Zoom Workplace usage and the Zoom API usage via the OAuth app is lowering user satisfaction.

■Improvement Request
If Zoom functionality is being used via Zoom Workplace, could you implement a mechanism where the refresh token does not expire, even without Zoom API usage via an OAuth app? (For example, managing Zoom functionality usage per Zoom account, and extending the refresh token’s validity period if Zoom functionality is used via Zoom Workplace.)

We kindly request your consideration.

2

hi @suzunosuke.miyahara ,

Ssssshhhhhhh don’t shout this out too much.

Zoom is a product of tick boxes. Very little is hard coded.

All the features of zoom are options which zoom chooses and makes into products.

This applies to the Refresh token. 90 days is the reasonable time limit that zoom chose as default.

Remember that the auth token needs renewal after one hour and that will give you a new refresh token too. So if why would you not be using any api for weeks and weeks?

They will not thank me, if everyone now asks to change this.

However, if you have a good reason for why you are going to publish as app that would need another value, then the conversation could be had.

Please let me repeat. This is a value that can be changed on your app, but you need a really good business reason and for security reasons I as skeptical of needing longer values.
Remember that the auth token needs renewal after one hour and that will give you a new refresh token too.

John