# Does zoom support more than two environments for oauth2? **URL:** \ **Category:** API and Webhooks\ **Created:** [April 3, 2020, 10:50pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052 "2020-04-03T22:50:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 3, 2020, 10:50pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/1 "2020-04-03T22:50:17Z")
**Description** Currently, I can enter only two redirect URIs one for development and one for production. Our application has three environments: development, staging, and production. Should I redirect staging users to the development URI after the `authorize` request? Or maybe create one zoom app for my development environment and one zoom app for staging and production? What’re your recommendations? **Another question:** Does it safe to expose the authorization code to the user (browser)? Not the access token of course, just the code, and then the browser will send the code to my server to generate the access token and make the requests to zoom API secretly. Thanks, * * * **Which App Type?** OAuth **Which Endpoint/s?** **How To Reproduce (If applicable)** N/A **Screenshots (If applicable)** N/A ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 3, 2020, 10:59pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/2 "2020-04-03T22:59:33Z")
Hey @michael.solomon, thanks for posting and using Zoom! > [@michael.solomon](#): > > Should I redirect staging users to the development URI after the `authorize` request? Or maybe create one zoom app for my development environment and one zoom app for staging and production? > What’re your recommendations? Few options, you could use 1 OAuth app, and then redirect to the respective environment by whitelisting your environment domain names. Due note that the Redirect URL and whitelist URLs need to have the same base domain. So you could add a sub domain redirect for each environment. Or you could create a different OAuth app for each stage, however, a Zoom OAuth app has a development and production environment with separate credentials already built into a single OAuth app, so you could use the Testing Credentials for both development and staging. > [@michael.solomon](#): > > Does it safe to expose the authorization code to the user (browser)? Not the access token of course, just the code, and then the browser will send the code to my server to generate the access token and make the requests to zoom API secretly. Yes it is safe, and that is the recommended / industry standard [OAuth2](https://marketplace.zoom.us/docs/guides/auth/oauth) flow. 🙂 Let me know if that helps! Thanks, Tommy ---
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 3, 2020, 11:20pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/3 "2020-04-03T23:20:30Z")
Thanks for your quick response @tommy! About your first suggestion for my first question. Maybe I don’t understand you correctly but the redirect uri has to be static, isn’t ? so for example if I have `dev.example.com` and `stg.example.com` I can’t put both uris in the redirect uri app configuration. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 3, 2020, 11:58pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/4 "2020-04-03T23:58:09Z")
Hey @michael.solomon, It can be dynamic! 🙂 So both those URLs would work! As long as they are listed in the whitelist URLs. Thanks, Tommy ---
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 4, 2020, 8:41am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/5 "2020-04-04T08:41:16Z")
@tommy Thanks! I tried to set `redirect URI` to `http://localhost:300*/`, and it seems like it’s working!! I can’t find documentation about the syntax. can you help to find it? (maybe there are other special chars I can use). > It can be dynamic! 🙂 How dynamic it can or should be? The following would work? 1. `Redirect URL for OAuth` set to: > [https://example.com/projects/\*/page1/\](https://example.com/projects/%5C*/page1/%5C)\* 1. The browser sends the user to the following URL: > [https://zoom.us/oauth/authorize?response\_type=code&client\_id=\*\*\*&redirect\_uri=https://example.com/projects/12324/page1/432432](https://zoom.us/oauth/authorize?response_type=code&client_id=%5C*%5C*%5C*&redirect_uri=https://example.com/projects/12324/page1/432432) 1. User successfully authorized and redirected to: > [https://example.com/projects/12324/page1/432432](https://example.com/projects/12324/page1/432432) 1. The browser sends the authorization code AND the redirect uri to my server. 2. The server sends the following request: ```auto POST https://api.zoom.us/oauth/token redirect_uri = https://example.com/projects/12324/page1/432432 ``` I’m sorry if I’m asking too specific questions, we have extreme time constraints in those days and I want to be sure I’m doing things right. Thanks! ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 6, 2020, 5:25pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/6 "2020-04-06T17:25:57Z")
Hey @michael.solomon, You would just need to whitelist `https://example.com`, then you can redirect to any path or sub domain on that URL. Thanks, Tommy ---
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 6, 2020, 5:42pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/7 "2020-04-06T17:42:36Z")
Thanks @tommy, the redirect uri in the zoom app configuration has to be regex or something, otherwise I’ll get mismatch on the code to token request, isn’t? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 6, 2020, 10:44pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/8 "2020-04-06T22:44:31Z")
Hey @michael.solomon, Correct. Thanks, Tommy ---
**Author:** ![tuancode](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tuancode](https://devforum.zoom.us/u/tuancode)\ **Post date:** [April 14, 2020, 7:18am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/9 "2020-04-14T07:18:56Z")
Hi @tommy, Our company provide an SaaS where each client site is distinct via a subdomain. We want to integrate Zoom in our Base Software, then all clients can use it. We created one Zoom Oauth2 App for integration and our client users can authorize using their zoom accounts. The problem is the redirect url base on our client subdomains, but we have too many clients (more than 500 and might be more in the future), hence it will be very painful to manually add these subdomains to the White List in Oauth2 configuration page. Do you have any suggestion? Thanks! ---
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 14, 2020, 7:40am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/10 "2020-04-14T07:40:33Z")
@tuancode Did you try to add `https://*.example.com` to your whitelist? ---
**Author:** ![tuancode](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tuancode](https://devforum.zoom.us/u/tuancode)\ **Post date:** [April 14, 2020, 10:04am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/11 "2020-04-14T10:04:23Z")
Thank you. I already tried it but unfortunately it responded **Invalid redirect** ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 15, 2020, 8:14pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/12 "2020-04-15T20:14:52Z")
Hey @tuancode, @michael.solomon, This is totally possible! 🙂 Let me walk you through how to do this with the base domain of `example.com` For your whitelist, simply add your base domain: `https://example.com` Then in your dev/prod redirect url field, add a default redirect, `https://any.example.com` (this will be programmatically overridden to the correct sub domain, continue reading below) Now, with your install URL ([the url mentioned in Step 1. of the OAuth guide](https://marketplace.zoom.us/docs/guides/auth/oauth#getting-access-token)) in your code, dynamically set the respective sub domain on the redirect. For `https://sub1.example.com`: `https://zoom.us/oauth/authorize?response_type=code&client_id=7lstjK9NTyett_oeXtFiEQ&redirect_uri=https://sub1.example.com` For `https://sub2.example.com`: `https://zoom.us/oauth/authorize?response_type=code&client_id=7lstjK9NTyett_oeXtFiEQ&redirect_uri=https://sub2.example.com` Let me know if that helps! 🙂 Thanks, Tommy ---
**Author:** ![michael.solomon](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@michael.solomon](https://devforum.zoom.us/u/michael.solomon)\ **Post date:** [April 15, 2020, 8:33pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/13 "2020-04-15T20:33:02Z")
@tommy Thanks a lot! I highly recommend that you add this in your documentation because this is a sort of a gray area in oauth2, and each Authorization Server implements this slightly different. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 16, 2020, 5:54am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/14 "2020-04-16T05:54:41Z")
You are welcome @michael.solomon! Thanks for the suggestion, we will add this! -Tommy ---
**Author:** ![tuancode](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tuancode](https://devforum.zoom.us/u/tuancode)\ **Post date:** [April 16, 2020, 6:07am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/15 "2020-04-16T06:07:40Z")
Thanks @tommy, It works really well. I agree with @michael.solomon that this part can be tricky if it isn’t included in the documentation. ---
**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\ **Post date:** [April 16, 2020, 8:23pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/16 "2020-04-16T20:23:51Z")
Thanks @michael.solomon @tuancode & @tommy - we’ll work on adding this to our docs 🙂 ---
**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\ **Post date:** [April 18, 2020, 6:58pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/17 "2020-04-18T18:58:24Z")
For future reference: [OAuth - Advanced Practices](https://marketplace.zoom.us/docs/guides/auth/oauth#advanced) ---
**Author:** ![rahul5](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/rahul5/32/10849_2.png) [@rahul5](https://devforum.zoom.us/u/rahul5)\ **Post date:** [July 13, 2020, 3:09pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/19 "2020-07-13T15:09:21Z")
@michael.zoom What will happen If I update the user settings from development environment? Will production environment also be able to update the setting for the same user? Please look into the below mentioned ticket as well - > [@Expiry details for webinars/meetings not clear](https://devforum.zoom.us/t/expiry-details-for-webinars-meetings-not-clear/22597/11): > > @tommy Thanks for the reply, I have a question - For which I need answers to on urgent basis - I have implemented - [Update User Settings API](https://marketplace.zoom.us/docs/api-reference/zoom-api/users/usersettingsupdate) . We are using this API for setting "embed\_password\_in\_join\_link, so that users will always have an embedded password in their join link. In our development app this is working properly but in production it is throwing error - "Invalid access token, does not contain scopes: [user:write:admin, user:write, zms:user:write]." I deauthorized app from Instal… ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 16, 2020, 5:49pm UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/20 "2020-07-16T17:49:49Z")
Hey @rahul5, > [@rahul5](#): > > What will happen If I update the user settings from development environment? Will production environment also be able to update the setting for the same user? Yes! We will look into your other question in a moment. Thanks, Tommy ---
**Author:** ![victor-zmurl](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/victor-zmurl/32/13199_2.png) [@victor-zmurl](https://devforum.zoom.us/u/victor-zmurl)\ **Post date:** [August 21, 2020, 6:04am UTC](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052/21 "2020-08-21T06:04:58Z")
Hi @michael.zoom and @tommy thank you for your helpful answers here! Are we able to have multiple redirect OAuth URLs that are not on the same domain? A couple example use cases: 1. We are rebranding so for a short period we will have two main URLs 2. We want to create some marketing sites that allow Login with Zoom but won’t have our same domain [Next page](https://devforum.zoom.us/t/does-zoom-support-more-than-two-environments-for-oauth2/11052.md?page=2)