# JWT Apps Security Concerns

**URL:** <https://devforum.zoom.us/t/jwt-apps-security-concerns/82849>\
**Category:** API and Webhooks\
**Created:** [February 9, 2023, 12:29pm UTC](https://devforum.zoom.us/t/jwt-apps-security-concerns/82849 "2023-02-09T12:29:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bmartin](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@bmartin](https://devforum.zoom.us/u/bmartin)\
**Post date:** [February 9, 2023, 12:29pm UTC](https://devforum.zoom.us/t/jwt-apps-security-concerns/82849/1 "2023-02-09T12:29:03Z")

</div>

Here [https://marketplace.zoom.us/docs/guides/auth/jwt/](https://marketplace.zoom.us/docs/guides/auth/jwt/) it says:

> Note: JWT may only be used for internal applications and processes. All apps created for third-party usage must use our OAuth app type.

Why? What is wrong with using this in my web application for my external end-users?

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [February 9, 2023, 3:02pm UTC](https://devforum.zoom.us/t/jwt-apps-security-concerns/82849/2 "2023-02-09T15:02:47Z")

</div>

A JWT application can only perform activities on behalf of users that are part of your account. It won’t have access to user information for anyone else. Maybe that’s sufficient for your purposes, like adding an end user’s email address (that they provided directly to you, not to Zoom) as a panelist or attendee to a webinar that one of your Zoom account’s users will host.

That said, [JWT apps are scheduled to stop working in June 2023](https://marketplace.zoom.us/docs/guides/build/jwt-app/); you should build or migrate to a [Server-to-Server OAuth application](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/) instead.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [February 13, 2024, 6:38am UTC](https://devforum.zoom.us/t/jwt-apps-security-concerns/82849/3 "2024-02-13T06:38:58Z")

</div>

Closed on February 13, 2024, 6:38am UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.