# JWT Deprecation - next steps

**URL:** <https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767>\
**Category:** API and Webhooks\
**Created:** [September 30, 2022, 3:41pm UTC](https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767 "2022-09-30T15:41:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![patrickgi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/patrickgi/32/35452_2.png) [@patrickgi](https://devforum.zoom.us/u/patrickgi)\
**Post date:** [September 30, 2022, 3:41pm UTC](https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767/1 "2022-09-30T15:41:28Z")

</div>

I have several apps at work that interact heavily with the Rest API. I use the JWT method for authentication, and I can see that this will be deprecated in 2023. These are internal apps, used only by me and my team. I don’t want a published/public app, I just want to make sure these automations keep running through 2023. So, I’m looking at the Server-To-Server app type, as that is what is recommended in the deprecation info.

What I don’t understand is the part with scopes. I don’t want to scope certain portions of the Rest API, I just want a durable set of credentials that give me access to every every endpoint the API has to offer, for whatever requests I get. The app doesn’t activate unless I scope out certain fields. Should my next move to be to just check every box that is offered? Can there be a ‘check all’ feature, if this is the case? If not, how am should I be thinking of this differently?

Thanks,

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [September 30, 2022, 3:49pm UTC](https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767/2 "2022-09-30T15:49:42Z")

</div>

Hi @patrickgi ,

> [@patrickgi](#):
>
> I don’t want to scope certain portions of the Rest API, I just want a durable set of credentials that give me access to every every endpoint the API has to offer, for whatever requests I get.

I totally understand this. We have scopes to enhance account info security, but you can select all the scopes if you truly want access to all of them. There is no “check all” feature. Hope this helps!

---

<div class="post-metadata">

**Author:** ![patrickgi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/patrickgi/32/35452_2.png) [@patrickgi](https://devforum.zoom.us/u/patrickgi)\
**Post date:** [September 30, 2022, 3:53pm UTC](https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767/3 "2022-09-30T15:53:37Z")

</div>

It does, and I totally get the heightened security!

Thanks,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [October 4, 2023, 7:29am UTC](https://devforum.zoom.us/t/jwt-deprecation-next-steps/76767/4 "2023-10-04T07:29:46Z")

</div>

Closed on October 4, 2023, 7:29am UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.