# Jwt Token Validation

**URL:** <https://devforum.zoom.us/t/jwt-token-validation/6765>\
**Category:** API and Webhooks\
**Created:** [November 21, 2019, 3:16pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765 "2019-11-21T15:16:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![k.krylov](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/k.krylov/32/316_2.png) [@k.krylov](https://devforum.zoom.us/u/k.krylov)\
**Post date:** [November 21, 2019, 3:16pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765/1 "2019-11-21T15:16:03Z")

</div>

**Description/Error**  
refresh\_token and acceess\_token obtained from [https://oauth.zoom.us](https://oauth.zoom.us) upon successful OAuth flow contain signature that I am unable to validate. Please advise what secret I shall use to validate incoming tokens?

Thank you

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [November 21, 2019, 7:09pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765/2 "2019-11-21T19:09:07Z")

</div>

Hey @k.krylov,

I am not sure what you mean by “validate incoming tokens”?

Can you please clarify or give an example?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![k.krylov](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/k.krylov/32/316_2.png) [@k.krylov](https://devforum.zoom.us/u/k.krylov)\
**Post date:** [November 21, 2019, 7:34pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765/3 "2019-11-21T19:34:25Z")

</div>

I am getting the token however I don’t know it’s coming from you or from someone else in the middle. Just like you want the Client to sign the JWT with the secret i want to make sure that the token coming back from you is also valid otherwise why bother sending it in JWT format. The response asserts identity and yields sensitive data, considering that I am not in the environment with clean internet I would like to validate the token. It must be signed with a symmetric key and I need to know what it is.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [November 21, 2019, 11:11pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765/4 "2019-11-21T23:11:35Z")

</div>

Hey @k.krylov,

I am still confused.

Yes Zoom access\_tokens are in a JWT format, but the access\_tokens can only come from Zoom so no need to validate it.

> **[OAuth with Zoom - OAuth - Authorization - Documentation](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom#request-access-token)**
>
> OAuth with Zoom
> 
> 
> 
> Below are examples of how to send requests for Access Tokens and handle responses for OAuth app authentication and authorization with...

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 7:05pm UTC](https://devforum.zoom.us/t/jwt-token-validation/6765/5 "2020-08-21T19:05:02Z")

</div>

Closed on August 21, 2020, 7:05pm UTC