# Longevity of OAuth UserManaged code

**URL:** <https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014>\
**Category:** API and Webhooks\
**Created:** [May 10, 2020, 11:17pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014 "2020-05-10T23:17:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\
**Post date:** [May 10, 2020, 11:17pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014/1 "2020-05-10T23:17:02Z")

</div>

when an user provide authorization to Marketplace application and Zoom sends code as querystring to RedirectURLforOAuth…how long is that code valid to utilize with Zoom application client ID/SECRET to generate access/refresh token? thanks…

---

<div class="post-metadata">

**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\
**Post date:** [May 13, 2020, 3:47pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014/2 "2020-05-13T15:47:58Z")

</div>

Hi @sabraha5, an authorization code is unique to each authorization and should be used **immediately** to retrieve an access token. I’d store/cache the refresh token to get a new access token rather than the authorization code.

---

<div class="post-metadata">

**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\
**Post date:** [May 13, 2020, 4:41pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014/3 "2020-05-13T16:41:59Z")

</div>

hey @michael.zoom…thank you for the response…we are working through the process of handling the RedirectURLforOAuth request and determining whether we needed to generate the access/refresh token immediately…but there isn’t a defined lifetime for the authorization code but best practice to utilize immediately to retrieve access/refresh token and keep those secure…appreciate your feedback/guidance!

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [May 13, 2020, 10:16pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014/4 "2020-05-13T22:16:25Z")

</div>

Hey @sabraha5,

The correct flow is to get the access / refresh tokens immediately upon redirect. 🙂

> **[OAuth 2.0 - Authorization - Documentation](https://marketplace.zoom.us/docs/guides/auth/oauth#getting-access-token)**
>
> OAuth with Zoom
> 
> The Zoom API uses OAuth 2.0 to authenticate and authorize users to make requests. To setup access credentials and request scopes for yo...

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 9:18pm UTC](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014/5 "2020-08-21T21:18:25Z")

</div>

Closed on August 21, 2020, 9:18pm UTC