/oauth/authorize endpoint only asks for user credentials once, impeding us to login with different users

API and Webhooks Authentication
1

Format Your New Topic as Follows:

API Endpoint(s) and/or Zoom API Event(s)
https://zoom.us/oauth/authorize

Description

The /oauth/authorize endpoint only asks for Zoom credentials once. Afterwards, it chooses the previously selected credentials, without asking the user to specifically choose the account they wish to sign-up / sign-in with.

This prevents us from developing the following use-case in our app:

  • Allow users to connect / disconnect from Zoom, using OAuth for creating said connection
  • User A could login onto our app, connect to Zoom, then logout from our app
  • User B could then login onto our app using the same device and browser as User A, and try to connect to Zoom, but without knowing it, the endpoint will automatically sign-in with User A’s Zoom account information, thus creating an issue

How To Reproduce

1 - Redirect a user to: https://zoom.us/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI

  • An OAuth screen will be shown, inviting the user to either accept or reject the OAuth app’s scopes, and to choose the Zoom account they want to log in with

2 - Have that user choose their Zoom account, and log in with it

3 - Redirect a different user to the previous URL, within the same device and browser

  • No OAuth screen is shown, and the previously chosen Zoom account for the former user is selected automatically
2

@danielmarcano this is expected, because the user has already authorized the app. If the access token were to be revoked or the user deauthorizes the app, then the OAuth screen will be shown again.

3

Hi, @ojus.zoom, thank you for the reply!

If this is expected, what could we do to fulfill the use-case I have described?

1 Like
4

Hey @danielmarcano , how did you get this fixed? I am facing the same problem here.

5

@johnpisg You can consider revoking an access token: OAuth for user authorized apps , if you plan to show the authorization window to your user everytime