# In-client OAuth and the authorize API

**URL:** <https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939>\
**Category:** Zoom Apps\
**Created:** [June 3, 2022, 4:33pm UTC](https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939 "2022-06-03T16:33:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![newzhenry](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/newzhenry/32/32179_2.png) [@newzhenry](https://devforum.zoom.us/u/newzhenry)\
**Post date:** [June 3, 2022, 4:33pm UTC](https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939/1 "2022-06-03T16:33:26Z")

</div>

I read the In-client OAuth documentation but it’s unclear to me when the authorize API should be called. Could someone please explain?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [June 22, 2022, 8:25pm UTC](https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939/2 "2022-06-22T20:25:13Z")

</div>

@newzhenry The `authorize()` API is used to request user authorization and is used in conjunction with the `onAuthorized` event to obtain the access token. More info on that [here](https://marketplace.zoom.us/docs/zoom-apps/guides/in-client-oauth).

This would be the similar to calling the /authorize route when using a standard [OAuth App](https://marketplace.zoom.us/docs/guides/auth/oauth/) flow.

Let me know if that helps.

---

<div class="post-metadata">

**Author:** ![bridger](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bridger/32/34722_2.png) [@bridger](https://devforum.zoom.us/u/bridger)\
**Post date:** [June 22, 2022, 9:25pm UTC](https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939/3 "2022-06-22T21:25:31Z")

</div>

Usually when asking the user for permission I wait until the app has a clear reason which the user can understand. What if we never need OAuth access for the app to function? Can we skip calling the authorize API?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [June 27, 2022, 9:06pm UTC](https://devforum.zoom.us/t/in-client-oauth-and-the-authorize-api/69939/4 "2022-06-27T21:06:30Z")

</div>

@bridger Yes, but you would still want to support a browser-based OAuth flow with your app (i.e. a redirect URL) so that users can install your app using their browser.