# JWT expiration clarification

**URL:** <https://devforum.zoom.us/t/jwt-expiration-clarification/65869>\
**Category:** Android\
**Created:** [March 15, 2022, 9:57pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869 "2022-03-15T21:57:22Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sdev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/sdev/32/33910_2.png) [@sdev](https://devforum.zoom.us/u/sdev)\
**Post date:** [March 15, 2022, 9:57pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/1 "2022-03-15T21:57:22Z")

</div>

**Description**  
I’m using a JWT to authenticate my Android Meeting SDK application. I’m hardcoding my JWT in my application only for development purposes (will not hardcode in production).

The documentation states that the **exp** and **tokenExp** values must be a minimum of 1800 seconds greater than the **iat** value, but when I set the **tokenExp** value to **iat** + 1800 and then use the JWT to initialize the SDK, I get error code: 1, internal error code: 0

I see in the documentation (screen shot below) that the **iat** should be set to the current time but since I’m hardcoding the JWT in my development app, there is a delay between when I issue the JWT and when it is actually used.

 ![Screen Shot 2022-03-15 at 2.13.49 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/7/c/7c9f6332c17be89836dfa57948c7936cf8ead4f2.png)

Interestingly, if I set the **exp** value to **iat** + 1800, even if **iat** is not equal to the current time, the JWT is valid.

It seems like minimum valid timestamps to initialize the SDK are,  
exp = iat + 1800  
tokenExp = currentTime + 1800

Is this a correct interpretation or is there an error in my JWT?

{  
“appKey”: “SDK\_KEY”,  
“iat”: 1647378148,  
“exp”: 1647464548,  
“tokenExp”: 1647379948  
}

**Which Android Meeting SDK version?**  
Android Meeting SDK version 5.9.6.4777

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [March 16, 2022, 4:18pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/2 "2022-03-16T16:18:56Z")

</div>

Hi @sdev, thanks for using our SDK.

The timespan between `iat` and `exp`/`tokenExp` represents the current time. So while your JWT will still work if the `iat` value is not the current time exactly, if you wait too long before using the JWT SDK auth will fail.

Thanks!

---

<div class="post-metadata">

**Author:** ![sdev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/sdev/32/33910_2.png) [@sdev](https://devforum.zoom.us/u/sdev)\
**Post date:** [March 17, 2022, 11:16pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/3 "2022-03-17T23:16:24Z")

</div>

Hi @jon.zoom, thank you for your response. I have a follow-up question,

I know that if I try to initialize the SDK with an expired token, the auth will fail and the SDK will not be initialized but what is the expected behavior if the token expires while I’m using the SDK?

For example, in my app I successfully initialize the SDK with a valid JWT. Then I wait until both the tokenExp and exp times have past. Once the token has expired, I can still join a meeting using the `joinMeetingWithParams` method and I can call other SDK methods. I don’t see any change in my app’s behavior once the token expires as long as the SDK is already initialized. Is this expected?

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [March 18, 2022, 4:59pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/4 "2022-03-18T16:59:55Z")

</div>

Hi @sdev,

If your auth session expires and you need to auth again, you will receive the [`onZoomAuthIdentityExpired`](https://marketplacefront.zoom.us/sdk/meeting/android/us/zoom/sdk/ZoomSDKAuthenticationListener.html#onZoomAuthIdentityExpired--) callback.

Thanks!

---

<div class="post-metadata">

**Author:** ![sdev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/sdev/32/33910_2.png) [@sdev](https://devforum.zoom.us/u/sdev)\
**Post date:** [March 21, 2022, 9:57pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/5 "2022-03-21T21:57:05Z")

</div>

Thank you @jon.zoom. I’m receiving the auth session expired event in the `onZoomAuthIdentityExpired` callback. However, even after the auth session expires, I can still use the SDK to join a meeting as a non-login user.

I assumed that once the auth session expired, I wouldn’t be able to use the SDK until I provided a new authentication token, but this is not what I’m experiencing in my app. What features of the SDK are no longer available once the auth session expires?

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [March 22, 2022, 5:01pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/6 "2022-03-22T17:01:20Z")

</div>

Hi @sdev,

Are you sure that you’re seeing the `onZoomAuthIdentityExpired` callback and not the similarly named `onZoomIdentityExpired` one? You should not be able to use the SDK to join a meeting after receiving the first one.

Thanks!

---

<div class="post-metadata">

**Author:** ![sdev](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/sdev/32/33910_2.png) [@sdev](https://devforum.zoom.us/u/sdev)\
**Post date:** [March 22, 2022, 5:42pm UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/7 "2022-03-22T17:42:38Z")

</div>

Yes, I’m using `onZoomAuthIdentityExpired`. I see the debug messages from both ZoomSDKAuthenticationListener and ZoomSDKInitializeListener in the log when the session expires.

```auto
private val sdkInitListener = object : ZoomSDKInitializeListener {
        /**
         * If the [errorCode] is [ZoomError.ZOOM_ERROR_SUCCESS], the SDK was initialized and can
         * now be used to join/start a meeting.
         */
        override fun onZoomSDKInitializeResult(errorCode: Int, internalErrorCode: Int) {
            if (errorCode == ZoomError.ZOOM_ERROR_SUCCESS && meetingId != null && meetingPwd != null) {
                joinMeeting(applicationContext, meetingId!!, meetingPwd!!)
            } else {
                Toast.makeText(applicationContext, "error code: $errorCode, internal error code: $internalErrorCode", Toast.LENGTH_SHORT).show()
            }
        }
        override fun onZoomAuthIdentityExpired() {
            Log.d("myzoomsample", "onZoomAuthIdentityExpired triggered")
        }
    }

    private var authenticationListener = object : ZoomSDKAuthenticationListener {
        override fun onZoomSDKLoginResult(p0: Long) {}

        override fun onZoomSDKLogoutResult(p0: Long) {}

        override fun onZoomIdentityExpired() {}

        override fun onZoomAuthIdentityExpired() {
            Log.d("myzoomsample", "EXPIRED Auth!")
        }
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [April 22, 2022, 3:42am UTC](https://devforum.zoom.us/t/jwt-expiration-clarification/65869/8 "2022-04-22T03:42:42Z")

</div>

Closed on April 22, 2022, 3:42am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.