# How do we stop using refresh\_token in query parameters?

**URL:** <https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830>\
**Category:** API and Webhooks\
**Tags:** api\
**Created:** [January 20, 2023, 6:42pm UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830 "2023-01-20T18:42:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Delenta](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Delenta](https://devforum.zoom.us/u/Delenta)\
**Post date:** [January 20, 2023, 6:42pm UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/1 "2023-01-20T18:42:36Z")

</div>

We got this email:

> As a part of our continuing efforts to improve the security of Zoom OAuth App Types using Authorization flow, we are removing the ability to set the access tokens, refresh tokens and revoke tokens in the URL query parameters. This change will take effect on February 14th, 2023.
> 
> It is strongly recommended that you update your API calls to set the token values in the Authorization header and not the HTTP query parameters. Failure to do so will result in rejected API calls and a reduced functionality for your application.
> 
> You can read more about the change on the FAQ and how to do OAuth via the Authorization header.

And you do clearly state there “, refresh tokens and revoke tokens”.

But the " OAuth via the Authorization header" link goes straight to [https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token](https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token) which shows the exact thing you are apparently removing.

And [https://devsupport.zoom.us/hc/en-us/articles/12363164278669-API-access-token-change](https://devsupport.zoom.us/hc/en-us/articles/12363164278669-API-access-token-change) only talks of access\_token.

So how do we comply with your new policy?

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [January 20, 2023, 10:34pm UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/2 "2023-01-20T22:34:53Z")

</div>

Hi @Delenta ,

Those values should be sent in the **request body** as opposed to the request header, but I see the confusion in our docs.

Here it is in our public workspace: [Postman](https://www.postman.com/zoom-developer/workspace/zoom-public-workspace/request/22097587-a8c07ce1-cdcb-4e03-ad40-e1ba7bc2c7ae?ctx=documentation)

 ![Screen Shot 2023-01-20 at 2.33.52 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/0/b/0ba5ed053234576c18286f6c0e954a19b3fb615b.jpeg)

Try it out and let me know if it is clearer. I will make a request to revise our docs 🙂

---

<div class="post-metadata">

**Author:** ![Delenta](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Delenta](https://devforum.zoom.us/u/Delenta)\
**Post date:** [January 21, 2023, 12:07am UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/3 "2023-01-21T00:07:16Z")

</div>

Ok thanks, a follow question as well, since I noticed you put grant\_type in body, if I call like:

```
/oauth/token?grant_type=${grantType}&code=${code}&redirect_uri=${redirectUri}

```

Does that mean that all of those, including code and redirect\_uri, need to be request body params; in other words you are actually disabling all query parameter passed arguments?

---

<div class="post-metadata">

**Author:** ![Delenta](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Delenta](https://devforum.zoom.us/u/Delenta)\
**Post date:** [January 21, 2023, 12:21am UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/4 "2023-01-21T00:21:01Z")

</div>

By looking at the actual example on the postman it seems yes, everything should use post fields now

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [January 21, 2023, 12:27am UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/5 "2023-01-21T00:27:47Z")

</div>

Happy to help! Take care!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [January 24, 2024, 4:04pm UTC](https://devforum.zoom.us/t/how-do-we-stop-using-refresh-token-in-query-parameters/81830/6 "2024-01-24T16:04:05Z")

</div>

Closed on January 24, 2024, 4:04pm UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.