# OAuth Access Tokens

**URL:** <https://devforum.zoom.us/t/oauth-access-tokens/77979>\
**Category:** Authentication\
**Tags:** recording, oauth\
**Created:** [October 27, 2022, 2:40pm UTC](https://devforum.zoom.us/t/oauth-access-tokens/77979 "2022-10-27T14:40:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![idressos](https://avatars.discourse-cdn.com/v4/letter/i/43a26b/32.png) [@idressos](https://devforum.zoom.us/u/idressos)\
**Post date:** [October 27, 2022, 2:40pm UTC](https://devforum.zoom.us/t/oauth-access-tokens/77979/1 "2022-10-27T14:40:10Z")

</div>

I’m using a Server-to-Server OAuth app to:

1. Get notified when a meeting recording is complete
2. Attempt to download the recording files using the download token  
2.1. Save the download token in a DB in case a download fails
3. Check manually/automatically for failed downloads and retry:

- If the download token has expired, get a new OAuth access token
- If it hasn’t, use the same download token

The process described above is ran asynchronously in multiple threads, so multiple downloads can be running at once.  
This means that multiple threads may try to get an OAuth access token, or use the same download token for different files of the same recording at the same time.

The problem is, sometimes downloads fail because Zoom returns with a 401 status code. This happens randomly with either download or access tokens.

What could this be? Do both token types become invalid after use? Is there any other limiting factor?

---

<div class="post-metadata">

**Author:** ![david5](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/david5/32/40553_2.png) [@david5](https://devforum.zoom.us/u/david5)\
**Post date:** [October 27, 2022, 3:33pm UTC](https://devforum.zoom.us/t/oauth-access-tokens/77979/2 "2022-10-27T15:33:06Z")

</div>

From what I’ve seen there are several issues with Server-to-Server OAuth tokens.

I’ve never been able to download recordings using a Server-to-Server OAuth token, only the provided download token, which as you pointed out, only lasts for an hour. (JWT tokens work fine 😕 )

> [@401 error when downloading recording with Server-to-Server OAuth token](https://devforum.zoom.us/t/401-error-when-downloading-recording-with-server-to-server-oauth-token/74351/13):
>
> Hi, I am having the same issue with trying to download a recording using a server-to-server OAuth access token and I am getting a 401 error, whereas if I use my old JWT token it works fine. I’m wondering if there is any progress on this issue?

Even if the Server-to-Server OAuth tokens did work, if you have multiple threads all requesting access tokens, they’re stepping on each other since each request for an access token invalidates the previous token…so you h ave to request a token index increase and manage your own token rotation manually ☹

> [@Randomly receiving "Invalid access token" for Server-to-Server OAuth](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432/22):
>
> For posterity and anyone else who happens to run across this thread while scratching their head about how Server-to-Server OAuth works: Requesting a new Server-to-Server OAuth token invalidates the previous one. Zoom can increase the “index” count for your account, allowing you to request different tokens with different indexes that do not interfere with each other (i.e. requesting a token for index 1 doesn’t invalidate the token requested for index 2). The token index is specified in the call…