# Error in Refreshing with refresh tokens **URL:** \ **Category:** API and Webhooks\ **Created:** [July 24, 2019, 6:38pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163 "2019-07-24T18:38:16Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ezhilvelan006](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ezhilvelan006/32/1363_2.png) [@ezhilvelan006](https://devforum.zoom.us/u/ezhilvelan006)\ **Post date:** [July 24, 2019, 6:38pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/1 "2019-07-24T18:38:16Z")
I’m Integrating Zoom service with our service projects. Please have a look on below scenario Scenario 1: While Integrating Zoom account A with user A on project A,B I’m getting same access token and refresh tokens no problems arise. Scenario 2: While Integrating Zoom account A with user A on project A and after 1hour integrating same Zoom account A with project B I’m getting different access token and refresh tokens (differ with project A ). After Integration I’m creating zoom meeting with project A after 1hour (token expired for project A). I’m getting response as **invalid access token** while hitting API call for updating new access and refresh token **.** I followed up with your documentation stats"Refresh Tokens have a lifespan of 15 years. When you refresh an access token, you will also get a new refresh token that you need to use in your next refresh. Store the new refresh token safely for the next time when you try to refresh the tokens." since i had not used up this refresh token before why i’m getting invalid refresh token(lifespan 15yrs). ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 24, 2019, 7:39pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/2 "2019-07-24T19:39:16Z")
Hey @ezhilvelan006 thanks for reaching out! I believe the issue is you generated a new `access_token` which then made your previous `refresh_token` invalid. Each time you refresh your `access_token` in the response you also get a new `refresh_token` that you need to use the next time you refresh your `access_token`. Also make sure your refresh token request is accurate POST REQUEST URL `https://zoom.us/oauth/token?grant_type= refresh_token&refresh_token={{ REFRESH TOKEN HERE }}` POST REQUEST BODY: ```json { "Authorization" : "Basic base64Encode({{client_id here}}:{{client_secret here}})" } ``` Does that help explain things? Thanks, Tommy ---
**Author:** ![ezhilvelan006](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ezhilvelan006/32/1363_2.png) [@ezhilvelan006](https://devforum.zoom.us/u/ezhilvelan006)\ **Post date:** [July 25, 2019, 5:01am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/3 "2019-07-25T05:01:34Z")
No Tommy. I had not generated new **access\_token**. At very first time, I’m integrating Zoom account A and stored all the details from response. I’m just integrated the same Zoom account A again after 1 hour in that i found different **different access and refresh tokens**. Is 1st integration details will not be valid after 2nd integration with same Zoom account ???. Using 1st integration details i’m trying to create a Zoom meeting link. But i found access token expired so i’m refreshing 1st integration details with refresh token (token received on 1st integration). In this scenario i’m getting response as invalid refresh token. My question is why refresh token is to be invalid since i had not used anywhere this refresh token, i’m integrated the same zoom account again that all. How it will affect the 1st integration details. I followed up with your documentation - i found refresh token is valid for 15yrs until refreshing for new access token then how it been receiving response as invalid refresh token. Regards, Ezhilvelan ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 25, 2019, 4:07pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/4 "2019-07-25T16:07:00Z")
Hey @ezhilvelan006, I’m confused, what do you mean by “Integrating” (when you see the access and refresh tokens change)? Are you reinstalling the app or something else? Thanks, Tommy ---
**Author:** ![ezhilvelan006](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ezhilvelan006/32/1363_2.png) [@ezhilvelan006](https://devforum.zoom.us/u/ezhilvelan006)\ **Post date:** [July 26, 2019, 4:48am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/5 "2019-07-26T04:48:17Z")
Hey Tommy, Integration means Authentication using oAuth. Authenticating again using same Zoom account. No reinstalling the app. Thanks, Ezhilvelan ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 26, 2019, 5:39pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/6 "2019-07-26T17:39:40Z")
Thanks @ezhilvelan006, Can you double check you are following the correct flow? Here is the flow from start to finish on a per install basis, 1. Go to url below (or click install app button on app dashboard) to authorize your app, GET `https://zoom.us/oauth/authorize?response_type=code&client_id={YOUR_CLIENT_ID}&redirect_uri={YOUR_REDIRECT_URI}` Grab the **authorization code** in the redirect url `https://yourRedriectUrl.com?code={AUTHORIZATION_CODE}` 1. Then request an access token POST `https://zoom.us/oauth/token?grant_type=code&redirect_uri={YOUR_REDIRECT_URI}&code={AUTHORIZATION_CODE}` HEADERS: `{"Authorization": "Basic BASE64ENCODED(CLIENT_ID:CLIENT_SECRET)"}` This will give you an `access_token` and `refresh_token` The `access_token` is different per user and lasts for one hour. The `refresh_token` is different per user and lasts for 15 years (unless you refresh access\_token in which it becomes invalid and you get a new one) You want to store both of these. Now let’s say your `access_token` is no longer valid 1. You need to refresh the access\_token, POST `https://zoom.us/oauth/token?grant_type=refresh_token&refresh_token={REFRESH_TOKEN}` HEADERS: `{"Authorization": "Basic BASE64ENCODED(CLIENT_ID:CLIENT_SECRET)"}` Now this will return a new `access_token` AND a new `refresh_token`. You need to store these new values as the old ones are now invalid. You can use the `access_token` to call Zoom API’s, and when the `access_token` is expired, repeat step 3 for that user to get a new `access_token` and `refresh_token`. Let me know if this helps, otherwise I will look into your account specifically. Thanks, Tommy ---
**Author:** ![Ryan\_Chapman](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ryan_chapman/32/939_2.png) [@Ryan\_Chapman](https://devforum.zoom.us/u/Ryan_Chapman)\ **Post date:** [August 2, 2019, 6:56pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/7 "2019-08-02T18:56:46Z")
@tommy I’m not sure if this related but we’re seeing inconsistent refresh results. We are refreshing tokens in a batch and 99% of the time it works fine, but occasionally it will fail on a portion of the refresh requests with the Invalid refresh Token error message. Is this a known issue and what can we do about it so that our users are not constantly having to reauthorize our app? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 2, 2019, 7:23pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/8 "2019-08-02T19:23:33Z")
Hey @Ryan_Chapman, Possible duplicate / relation to: [https://devforum.zoom.us/t/how-to-refresh-token-if-refresh-token-in-incorrect](https://devforum.zoom.us/t/how-to-refresh-token-if-refresh-token-in-incorrect) Can you PM me with your app id (path in url when on app marketplace dashboard) and account email and we will take a look? Thanks, Tommy ---
**Author:** ![muhammad.faizan.cs](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/muhammad.faizan.cs/32/4144_2.png) [@muhammad.faizan.cs](https://devforum.zoom.us/u/muhammad.faizan.cs)\ **Post date:** [April 2, 2020, 7:14am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/9 "2020-04-02T07:14:46Z")
@tommy I am experiencing same issue, the token was authenticated only once. and when it was used to generate new, I got this error that its invalid refresh token. which is really wierd. I can be sure about it being a fresh one because whenever I refresh a token, I have an update call for it. however this my friend doesn’t seem to work. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 2, 2020, 7:00pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/10 "2020-04-02T19:00:52Z")
Hey @muhammad.faizan.cs, Can you confirm your app is still installed? Can you try reinstalling the app and trying the refresh flow again? (The reports we have gotten about this recently were looked into and they were due to users uninstalling the app, or the refresh token being user already). Thanks, Tommy ---
**Author:** ![ilia.krendelev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ilia.krendelev/32/5739_2.png) [@ilia.krendelev](https://devforum.zoom.us/u/ilia.krendelev)\ **Post date:** [April 22, 2020, 5:15pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/11 "2020-04-22T17:15:36Z")
Hey, @tommy. Seems that I have a problem refreshing token, that looks like mentioned above. 1. I have correct `access_token` and I have correct `refresh_token`. An `access_token` has been obtained once via OAuth. “Correct refresh\_token” = some time later after an error, I refresh token successfully with the `refresh_token` value I had (and which caused error on first usage). 2. I refresh `access_token` every time when I receive error code 124 (“Access token expired”) for any of my API requests. 3. I use PHP cURL to do this. 4. Sometimes (yes, it’s a floating problem) I receive HTML error “Invalid client\_id: (4,702)” on “grant\_type=refresh\_token&…” request and my application isn’t ready for that. Here are my HTTP dumps (with credentials and cookies obfuscated) with some of my notices, that might help to resolve my issue (and maybe some other’s ones): [https://pastebin.com/CL4bmh1W](https://pastebin.com/CL4bmh1W) In a few words: I see HTTP 302 redirect to a `zoom.us/oauth/signin` URL with empty client\_id parameter as a response to ?grant\_type=refresh\_token… request. Might it be a problem source? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 23, 2020, 6:52pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/12 "2020-04-23T18:52:05Z")
Hey @ilia.krendelev, Are you passing in the authorization header when refreshing the tokens each time? [https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing) ![Screen Shot 2020-04-23 at 12.51.45 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/6/6eb938b1f31a8d3e3850bad8571f4e68fee7c1b4.png) Thanks, Tommy ---
**Author:** ![ilia.krendelev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ilia.krendelev/32/5739_2.png) [@ilia.krendelev](https://devforum.zoom.us/u/ilia.krendelev)\ **Post date:** [April 24, 2020, 8:55am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/13 "2020-04-24T08:55:04Z")
Yes, I do that every time. In my dump paste I have replaced my authorization credentials by `BASE64_ENCODED_CLIENTID_colon_CLIENSECRET` placeholder, but they are present in every `grant_type=refresh_token` request and are correct (defined as constants and never changed). ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 28, 2020, 6:50pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/14 "2020-04-28T18:50:37Z")
Hey @ilia.krendelev, Thanks for the details, can you share your App name so I can investigate further? -Tommy ---
**Author:** ![miroslav.grozdanovsk](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@miroslav.grozdanovsk](https://devforum.zoom.us/u/miroslav.grozdanovsk)\ **Post date:** [May 26, 2020, 8:14am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/15 "2020-05-26T08:14:06Z")
Hi @tommy, I think I’m having a similar issue as @ezhilvelan006 who originally created this thread, but just switching his different “projects” with our “tenants”. We have multitenant support in our application, so a given user (with email A) can have accounts in both Tenant1 and Tenant2, which are totally isolated environments (with different login credentials). This means that if the user wants to connect our app to his Zoom account, he will repeat the OAuth flow twice, once for each tenant. The problem here is that once he completes the OAuth flow on the second tenant, he gets a new refresh token, which invalidates the previous refresh token that was created for the first tenant (stored separately). How can we go around this issue? One possible fix would be to store the ZoomUserId beside the refresh token, and when a new refresh token is generated, we update all DB records for that ZoomUserId. Does that make sense or there are other alternatives? Also this wouldn’t be that easy if we end up storing different tenant info in different databases, which we eventually plan to do so. Thank you, Miroslav ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 1, 2020, 9:07pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/16 "2020-06-01T21:07:04Z")
Hey @miroslav.grozdanovsk, Your best option here is to have 2 seperate OAuth apps, one for each tenant. > [@miroslav.grozdanovsk](#): > > One possible fix would be to store the ZoomUserId beside the refresh token, and when a new refresh token is generated, we update all DB records for that ZoomUserId. > Does that make sense or there are other alternatives? This is my other suggested solution! 🙂 Thanks, Tommy ---
**Author:** ![miroslav.grozdanovsk](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@miroslav.grozdanovsk](https://devforum.zoom.us/u/miroslav.grozdanovsk)\ **Post date:** [June 3, 2020, 11:33am UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/17 "2020-06-03T11:33:42Z")
Hi @tommy, The main problem with separate OAuth apps is that we create new tenants on each new registration in a fully automated way. So I’m guessing it wouldn’t be possible or desirable to keep creating N Oauth apps for N tenants. ---
**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\ **Post date:** [June 5, 2020, 11:46pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/18 "2020-06-05T23:46:42Z")
@miroslav.grozdanovsk are you able to store current refresh\_tokens for each userId? ---
**Author:** ![miroslav.grozdanovsk](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@miroslav.grozdanovsk](https://devforum.zoom.us/u/miroslav.grozdanovsk)\ **Post date:** [June 10, 2020, 1:00pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/19 "2020-06-10T13:00:14Z")
@michael.zoom, yes ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 15, 2020, 7:25pm UTC](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163/20 "2020-06-15T19:25:59Z")
Hey @miroslav.grozdanovsk, We will have multiple token support for each authenticated user in the future. > [@miroslav.grozdanovsk](#): > > The problem here is that once he completes the OAuth flow on the second tenant, he gets a new refresh token, which invalidates the previous refresh token that was created for the first tenant (stored separately). For now, you can update or share the tokens across the multiple logins / tenants. Thanks, Tommy [Next page](https://devforum.zoom.us/t/error-in-refreshing-with-refresh-tokens/5163.md?page=2)