# Newbie question on UserManaged OAuth **URL:** \ **Category:** API and Webhooks\ **Created:** [May 5, 2020, 8:46pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299 "2020-05-05T20:46:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\ **Post date:** [May 5, 2020, 8:46pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/1 "2020-05-05T20:46:48Z")
We need to utilize UserManaged OAuth to create meeting/webinar on behalf of users via Zoom API…and so wondering when we create the Marketplace Zoom application to have users within our account provide permission to manage meetings, does their authorization stay with this application…and so when we utilize the Zoom API from our code, do we use the client ID/SECRET associated to the application from our code calling the ZoomAPI and if we need to create on behalf of user who has provided permission then does it work because the application has the users permission? ---
**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\ **Post date:** [May 7, 2020, 12:17pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/2 "2020-05-07T12:17:27Z")
no worries about initial question about using user OAuth token rather than client ID/SECRET of the marketplace application…as it seems that it is required to use the user OAuth token provided once user provides acceptance to the authorization request…and so wondering how long-lived is the access/refresh token? do we need to request the user to provide approval to the authorization request? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 12, 2020, 9:20pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/3 "2020-05-12T21:20:31Z")
Hey @sabraha5, The access\_token lasts for 1 hour, and the refresh token lasts for 15 years. Checkout our guide here: > **[OAuth 2.0 - Authorization - Documentation](https://marketplace.zoom.us/docs/guides/auth/oauth)** > > OAuth with Zoom > > The Zoom API uses OAuth 2.0 to authenticate and authorize users to make requests. To setup access credentials and request scopes for yo... Thanks, Tommy ---
**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\ **Post date:** [May 12, 2020, 9:50pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/4 "2020-05-12T21:50:14Z")
thank you @tommy for the response! i was wondering does the authorization code provided have a lifetime or just a one-time use and no expiration? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 15, 2020, 10:27pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/5 "2020-05-15T22:27:13Z")
Hey @sabraha5, The authorization code in the redirect url query param should only be used once, right away [to get an access and refresh token](https://marketplace.zoom.us/docs/guides/auth/oauth). 🙂 Than you store and refresh the access and refresh tokens. Thanks, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 9:21pm UTC](https://devforum.zoom.us/t/newbie-question-on-usermanaged-oauth/16299/6 "2020-08-21T21:21:35Z")
Closed on August 21, 2020, 9:21pm UTC