# OAuth access\_token signature verification **URL:** \ **Category:** API and Webhooks\ **Created:** [February 5, 2020, 4:10pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899 "2020-02-05T16:10:34Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![vatuska](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vatuska/32/3143_2.png) [@vatuska](https://devforum.zoom.us/u/vatuska)\ **Post date:** [February 5, 2020, 4:10pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/1 "2020-02-05T16:10:35Z")
**Description** I setup OAuth application for testing and now I’m able to receive access\_token I see that it is signed JWT, where can I find the key to verify the signature? **Which App Type (OAuth / Chatbot / JWT / Webhook)?** OAuth ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [February 5, 2020, 5:34pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/2 "2020-02-05T17:34:18Z")
Hey @vatuska, thanks for posting and using Zoom! What do you need to verify the access\_token for? Thanks, Tommy ---
**Author:** ![vatuska](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vatuska/32/3143_2.png) [@vatuska](https://devforum.zoom.us/u/vatuska)\ **Post date:** [February 5, 2020, 5:49pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/3 "2020-02-05T17:49:51Z")
Hey, I need to retrieve some claims and the jjwt library complaints that I ignore the signature, I can split the token and base64 decode the middle part and deserialize the json manually, however it is kind of a good practice to verify the signature of signed tokens 🙂 ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [February 5, 2020, 6:01pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/4 "2020-02-05T18:01:46Z")
Hey @vatuska, Have you tried [JWT Decoding](https://jwt.io/) the access\_token to get the signature? Here is a related post: > [@Jwt Token Validation](https://devforum.zoom.us/t/jwt-token-validation/6765): > > Description/Error refresh\_token and acceess\_token obtained from [https://oauth.zoom.us](https://oauth.zoom.us) upon successful OAuth flow contain signature that I am unable to validate. Please advise what secret I shall use to validate incoming tokens? Thank you Thanks, Tommy ---
**Author:** ![vatuska](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vatuska/32/3143_2.png) [@vatuska](https://devforum.zoom.us/u/vatuska)\ **Post date:** [February 5, 2020, 6:43pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/5 "2020-02-05T18:43:03Z")
Yes, it decodes claims and the header, however, it expects me to know what the secret variable is to verify the signature, when I put my token there, it also complains that the signature is invalid, because there is “your-256-bit-secret” secret value used by default I need to decode the token on the side of my endpoint (which I use as redirect\_uri in OAuth application) to recognize whether this user logged in previously or not. If I use the library in my code to decode JWT it expects that I know the key to validate the signature and I don’t actually. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [February 5, 2020, 9:07pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/6 "2020-02-05T21:07:21Z")
I see @vatuska. Let me get back to you on how to verify the signature. (ZOOM-136554) Thanks, Tommy ---
**Author:** ![mhixson](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@mhixson](https://devforum.zoom.us/u/mhixson)\ **Post date:** [March 31, 2020, 9:03pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/7 "2020-03-31T21:03:43Z")
> [@tommy](#): > > Let me get back to you on how to verify the signature. (ZOOM-136554) Did you discover an answer to this? I have the same question. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 1, 2020, 6:59am UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/8 "2020-04-01T06:59:19Z")
Hey @mhixson, I believe the key is your secret key. Thanks, Tommy ---
**Author:** ![mhixson](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@mhixson](https://devforum.zoom.us/u/mhixson)\ **Post date:** [April 1, 2020, 8:00pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/9 "2020-04-01T20:00:57Z")
Where do I find my secret key? The signing algorithm for the access tokens I get from Zoom is HS512. As I understand it, that means the secret key used to verify the tokens is at least 64 bytes long. The only “secret” that I know about is my OAuth app’s client secret, which is a 32-character string. I tried repeating that string twice and taking the ascii bytes of the result, giving me 64 bytes to try as a secret key, but that didn’t appear to be the correct key. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 2, 2020, 6:31am UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/10 "2020-04-02T06:31:02Z")
Hey @mhixson, It would be the secret key in your app. If that is not it, we won’t reveal what the key is. Thanks, Tommy ---
**Author:** ![vatuska](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vatuska/32/3143_2.png) [@vatuska](https://devforum.zoom.us/u/vatuska)\ **Post date:** [April 9, 2020, 12:15pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/11 "2020-04-09T12:15:10Z")
Hey @tommy, the app secret key is not the HS512 key. It would be nice if Zoom used any asymmetric algorithm like Google, f.e., does. They have the list of public certificates [https://www.googleapis.com/oauth2/v3/certs](https://www.googleapis.com/oauth2/v3/certs) And when I need to verify their JWT id\_token 1. I have the “kid” header in the token 2. I use the corresponding public certificate to verify the signature 3. I don’t need to know the private key, which Google uses to sign JWT. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 10, 2020, 7:00am UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/12 "2020-04-10T07:00:19Z")
Hey @vatuska, I will bring this up to the team for discussion. Thanks, Tommy ---
**Author:** ![pavol.slido](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@pavol.slido](https://devforum.zoom.us/u/pavol.slido)\ **Post date:** [April 16, 2020, 7:56pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/13 "2020-04-16T19:56:12Z")
I’d also appreciate, if we could verify the JWT signature. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 17, 2020, 7:51pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/14 "2020-04-17T19:51:08Z")
Hey @pavol.slido, You can verify the [JWT token](https://marketplace.zoom.us/docs/guides/auth/jwt#generating-jwts) because it is generated by you. Can you elaborate more? Thanks, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 8:15pm UTC](https://devforum.zoom.us/t/oauth-access-token-signature-verification/7899/15 "2020-08-21T20:15:27Z")
Closed on August 21, 2020, 8:15pm UTC