# Migration from validation token to secret token **URL:** \ **Category:** API and Webhooks\ **Created:** [June 23, 2025, 2:39pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347 "2025-06-23T14:39:53Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 23, 2025, 2:39pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/1 "2025-06-23T14:39:53Z")
I switched my webhooks to use the “secret token” for webhook event notification verification, but the verification is failing. Is there something I need to do to switch from the “verification token” to the “secret token”. I saw one post that said both would be send, but I can’t comprehend how the signature that is sent would work as a hash for both tokens at once. Do I need to clear out the “verification token” (is that even possible). ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 23, 2025, 3:06pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/2 "2025-06-23T15:06:49Z")
Hi @springy_screenshare Thanks for reaching out to us and welcome to our Zoom Developer Community! I am happy to help here! Here is a link to a guide we have on verifying webhook events > **[Using webhooks](https://developers.zoom.us/docs/api/webhooks/#verify-webhook-events)** > > The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform. Let me know if this helps ---
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 23, 2025, 3:39pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/3 "2025-06-23T15:39:08Z")
yeah i’ve looked at that doc and I am doing what it says (and it’s been working for years now), but there’s no info there about transitioning from the old key to the new key. I created the new key, I add it to my code, but… what causes the webhooks to change so they send the signature using the new key instead of the old one? ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 25, 2025, 2:39pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/4 "2025-06-25T14:39:01Z")
When creating your signature to validate webhook events, you should be using the secret token. We will stop sending the verification token soon ---
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 25, 2025, 2:45pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/5 "2025-06-25T14:45:12Z")
“Soon”, but right now I’m getting warnings from Zoom that my webhooks will stop getting sent because they aren’t validating since I switched to the secret token… Is there not some migration process that can be done? ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 25, 2025, 8:50pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/6 "2025-06-25T20:50:55Z")
So basically if you are able to validate your endpoint URL, you are using the secret token correctly then. Are you able to validate your endpoint URL and receive events? ---
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 26, 2025, 1:20pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/7 "2025-06-26T13:20:12Z")
My endpoint URL is validated, its just since switching to the secret token that the webhooks events themselves don’t validate. I’m _still_ not clear on how the webhooks themselves know to send a hash of the secret token rather than the old verification token. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 26, 2025, 7:57pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/8 "2025-06-26T19:57:45Z")
I will send you a DM to look further into your account ---
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 27, 2025, 2:26pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/9 "2025-06-27T14:26:51Z")
Ok, so I updated the app webhook data so I could revalidate the webhook endpoint. That worked. Zoom says it’s valid and I see the 200 in my logs. But when I start a meeting to trigger the “start meeting” webhook, I still see that the event webhook request is not validating. I reconfirmed that the hash is being generated correctly on my side. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 27, 2025, 2:39pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/10 "2025-06-27T14:39:24Z")
This is the sample app that I use to test webhooks > So what you are saying is that the signature you are generating does not match the one returned in the headers? ---
**Author:** ![springy\_screenshare](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@springy\_screenshare](https://devforum.zoom.us/u/springy_screenshare)\ **Post date:** [June 27, 2025, 6:32pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/11 "2025-06-27T18:32:22Z")
Yeah the signatures don’t match. But my code is definitely using the right process to generate it from the key. I tried deleting the event subscription and creating a new one. It validates but then the webhook event hashes still don’t match. Do I need to completely recreate my Webhook Apps? ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [June 27, 2025, 6:34pm UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/12 "2025-06-27T18:34:18Z")
Not at all @springy_screenshare I do not think you need to recreate them. I would be happy to take a look at your code and help you debug. Have you been able to run the sample app that I shared using your credentials? Please follow up in the DM I sent ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [July 4, 2026, 4:51am UTC](https://devforum.zoom.us/t/migration-from-validation-token-to-secret-token/134347/14 "2026-07-04T04:51:15Z")
This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.