# JWT vs. OAuth Account Level Apps

**URL:** <https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204>\
**Category:** API and Webhooks\
**Created:** [May 5, 2020, 12:26pm UTC](https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204 "2020-05-05T12:26:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![clp207](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/clp207/32/7722_2.png) [@clp207](https://devforum.zoom.us/u/clp207)\
**Post date:** [May 5, 2020, 12:26pm UTC](https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204/1 "2020-05-05T12:26:45Z")

</div>

Is there a way to create multiple JWT apps and limit the permissions of what the app can do? Or is there a way to create an OAuth account level app that follows the client credentials Oauth flow and doesn’t require a redirect URL?

---

<div class="post-metadata">

**Author:** ![samly](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@samly](https://devforum.zoom.us/u/samly)\
**Post date:** [May 5, 2020, 12:29pm UTC](https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204/2 "2020-05-05T12:29:03Z")

</div>

I don’t think you can do an OAuth account-level app without going through the OAuth process at least once (and every time you need to update scopes).

It is pretty seamless after the first time though, as you can just store the latest refresh\_token to get a new access\_token when needed.

---

<div class="post-metadata">

**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\
**Post date:** [May 8, 2020, 8:45pm UTC](https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204/3 "2020-05-08T20:45:02Z")

</div>

Spot on @samly - thanks for answering.

@clp207 Admin-level permissions are given through OAuth (user-level tokens). A `refresh_token` can be stored for 15 years, given user permissions/scopes do not change.

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 9:07pm UTC](https://devforum.zoom.us/t/jwt-vs-oauth-account-level-apps/16204/4 "2020-08-21T21:07:16Z")

</div>

Closed on August 21, 2020, 9:07pm UTC