# OAuth Access and Refresh tokens

**URL:** <https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033>\
**Category:** API and Webhooks\
**Created:** [July 13, 2020, 10:53pm UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033 "2020-07-13T22:53:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sivanesan.murugesan](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sivanesan.murugesan](https://devforum.zoom.us/u/sivanesan.murugesan)\
**Post date:** [July 13, 2020, 10:53pm UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033/1 "2020-07-13T22:53:17Z")

</div>

Hi,  
If we get the multiple access tokens in a sequence, is the below case with refresh token valid?  
For example:

1. Request 1 gets access token A1 and refresh token R1
2. Request 2 gets access token A2 and refresh token R2
3. Request 3 gets access token A3 and refresh token R3

Assume access tokens are not expired yet. Will that work if I use A1 on my 4th Request(Request 4)? And can it be refreshed using R1 if it is expired.

We may see the above use case in our env, if same user tokens are used by multiple background threads and all of them are trying to refresh it?

Please let me know if the above query is not clear or for more details.

Thanks,  
smsivanesan

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [July 16, 2020, 4:03am UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033/2 "2020-07-16T04:03:36Z")

</div>

Hey @sivanesan.murugesan,

If I understand your question correctly, yes, each access token will work for any number of requests until an hour passes, you will then need to [refresh the token](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing).

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![sivanesan.murugesan](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sivanesan.murugesan](https://devforum.zoom.us/u/sivanesan.murugesan)\
**Post date:** [July 16, 2020, 4:08pm UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033/3 "2020-07-16T16:08:23Z")

</div>

Thanks Tommy. This clarifies. I was thinking that once the latest access token A3 accessed, A1 become invalid. Per your answer, all the tokens A1, A2 and A3 will work until they expired and each can be refreshed with their own refresh token R1, R2 and R3 respectively when they expire.

Thanks again.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [July 20, 2020, 11:18pm UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033/4 "2020-07-20T23:18:23Z")

</div>

Hey @sivanesan.murugesan,

Thanks for clarifying. Currently there can only be one access token and refresh token active per user.

> [@sivanesan.murugesan](#):
>
> Per your answer, all the tokens A1, A2 and A3 will work until they expired and each can be refreshed with their own refresh token R1, R2 and R3 respectively when they expire.

So this is not correct.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 10:47pm UTC](https://devforum.zoom.us/t/oauth-access-and-refresh-tokens/24033/5 "2020-08-21T22:47:31Z")

</div>

Closed on August 21, 2020, 10:47pm UTC