# JWT Token Restrictions

**URL:** <https://devforum.zoom.us/t/jwt-token-restrictions/57557>\
**Category:** API and Webhooks\
**Created:** [September 16, 2021, 5:04pm UTC](https://devforum.zoom.us/t/jwt-token-restrictions/57557 "2021-09-16T17:04:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![agffior](https://avatars.discourse-cdn.com/v4/letter/a/9de0a6/32.png) [@agffior](https://devforum.zoom.us/u/agffior)\
**Post date:** [September 16, 2021, 5:04pm UTC](https://devforum.zoom.us/t/jwt-token-restrictions/57557/1 "2021-09-16T17:04:28Z")

</div>

**Description**  
We are currently using JWT tokens to pull data from the Zoom API. However, we found out that we can perform all HTTP operations using the JWT token (POST, PATCH, DELETE). For security reasons, we just want to restrict the operations to GET.

**Which App Type (OAuth / Chatbot / JWT / Webhook)?**  
JWT

**Which Endpoint/s?**  
Sample Endpoint: [https://api.zoom.us/v2/metrics/meetings?from=2021-07-01&page\_size=10&type=past](https://api.zoom.us/v2/metrics/meetings?from=2021-07-01&page_size=10&type=past)

**How To Reproduce (If applicable)**  
Steps to reproduce the behavior:

1. Call Endpoint using PATCH or DELETE
2. Can make changes to data (which we don’t want)

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [September 17, 2021, 11:43pm UTC](https://devforum.zoom.us/t/jwt-token-restrictions/57557/2 "2021-09-17T23:43:29Z")

</div>

Hey @agffior,

Thank you for reaching out to the Zoom Developer Forum. Currently, we don’t have a method to restrict the scope of access when using a [JWT App](https://marketplace.zoom.us/docs/guides/auth/jwt).

When using an [OAuth App](https://marketplace.zoom.us/docs/guides/auth/oauth), you can select scopes that only allow reading of data, instead of writing, and this would effectively disable POST, PATCH, DELETE requests when using that app.

Let me know if that helps.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [October 18, 2021, 9:43am UTC](https://devforum.zoom.us/t/jwt-token-restrictions/57557/3 "2021-10-18T09:43:52Z")

</div>

Closed on October 18, 2021, 9:43am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.