# OAuth for server-to-server **URL:** \ **Category:** API and Webhooks\ **Created:** [March 2, 2020, 7:49pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354 "2020-03-02T19:49:01Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![pnarendra](https://avatars.discourse-cdn.com/v4/letter/p/51bf81/32.png) [@pnarendra](https://devforum.zoom.us/u/pnarendra)\ **Post date:** [March 2, 2020, 7:49pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/1 "2020-03-02T19:49:01Z")
**Description** I have a server-side application to access some Zoom APIs, which does not have any from-end UI. I am currently using JWT to authorize. I would like to switch to OAuth as it seems more secure compared to exposing my api\_secret in JWT. But OAuth requires a redirect URL, so it requires UI and user-interaction. Is there any way to get around this and do this completely automated through code? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [March 2, 2020, 8:27pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/2 "2020-03-02T20:27:52Z")
Hey @pnarendra, thanks for posting and using Zoom! > [@pnarendra](#): > > Is there any way to get around this and do this completely automated through code? There is, simply activate the OAuth install once. You can use any redirect url, like `https://zoom.us`. After install, get the auth code in the query param of the URL, and use it to [request an access\_token](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom). Now you can completely automate the process. Save the `access_token` and `refresh_token`, and implement logic that refreshes the `access_token`, and then makes the respective requests. Does that make sense? Thanks, Tommy ---
**Author:** ![pnarendra](https://avatars.discourse-cdn.com/v4/letter/p/51bf81/32.png) [@pnarendra](https://devforum.zoom.us/u/pnarendra)\ **Post date:** [March 2, 2020, 9:32pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/3 "2020-03-02T21:32:09Z")
> [@tommy](#): > > Does that make sense? It does. Thank you @tommy . Though I would like to ask details regarding creating the OAuth credentials. Since my application is not really an app, what information would be appropriate for for Privacy Policy URL, Terms of Use URL, etc., ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [March 2, 2020, 9:35pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/4 "2020-03-02T21:35:42Z")
Hey @pnarendra, If this is an internal app (only used by your Zoom account/users), it does not need to be published to the Zoom App Marketplace. You can ignore those fields 🙂 Thanks, Tommy ---
**Author:** ![pnarendra](https://avatars.discourse-cdn.com/v4/letter/p/51bf81/32.png) [@pnarendra](https://devforum.zoom.us/u/pnarendra)\ **Post date:** [March 2, 2020, 9:41pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/5 "2020-03-02T21:41:43Z")
Hey @tommy, If thats the case then how do you create the account-level credentials for OAuth Thank you for the help ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [March 2, 2020, 9:46pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/6 "2020-03-02T21:46:21Z")
Hey @pnarendra, Simply [create an Account Level OAuth app here](https://marketplace.zoom.us/develop/create), with Intent to Publish set to no. ![Screen Shot 2020-03-02 at 2.46.04 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/7/7b24dab9027c6d8fb13ca8e6f66131d0e7943c2f.jpeg) Thanks, Tommy ---
**Author:** ![pnarendra](https://avatars.discourse-cdn.com/v4/letter/p/51bf81/32.png) [@pnarendra](https://devforum.zoom.us/u/pnarendra)\ **Post date:** [March 2, 2020, 10:23pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/7 "2020-03-02T22:23:07Z")
Hey @tommy, That worked! thanks a lot for that! > [@tommy](#): > > Now you can completely automate the process. Save the `acces_token` and `refresh_token` , and implement logic that refreshes the `access_token` , and then makes the respective requests. Is there a way to increase the expiry time for the access token as 1 hr is too small a time period. I was wondering if there is a way to keep the access token for a day or two? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [March 2, 2020, 11:01pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/8 "2020-03-02T23:01:10Z")
Hey @pnarendra, happy to hear that worked! 🙂 > [@pnarendra](#): > > Is there a way to increase the expiry time for the access token as 1 hr is too small a time period. I was wondering if there is a way to keep the access token for a day or two? No, the `access_token` only lasts for 1 hour, however, you could simply [refresh the token](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom#refreshing) each time you make a request. That being said, the expiry setting is the benefit of using JWT, you can set it for any amount of time. Thanks, Tommy ---
**Author:** ![Dilip\_Reddy\_Guda](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@Dilip\_Reddy\_Guda](https://devforum.zoom.us/u/Dilip_Reddy_Guda)\ **Post date:** [June 29, 2020, 7:23pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/9 "2020-06-29T19:23:25Z")
@tommy is there a plan to increase the OAuth based access\_token expiry time to be more than 1 hour ? it would be great if there is an option to configure the expiry interval with upper bound set? Also is it like only one JWT app is allowed per organisation? We have one JWT app created and don’t see the marketplace allows to create 2nd JWT app ? is this the case? Problem with 1 JWT app (JWT Token) is the limited API rate limit. Regards Dilip ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [June 30, 2020, 10:29pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/10 "2020-06-30T22:29:54Z")
Hey @Dilip_Reddy_Guda, > [@Dilip\_Reddy\_Guda](#): > > is there a plan to increase the OAuth based access\_token expiry time to be more than 1 hour ? it would be great if there is an option to configure the expiry interval with upper bound set? There are no plans to increase the OAuth token expiry. You can refresh each time before you make a request if you would like: [https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing) > [@Dilip\_Reddy\_Guda](#): > > Also is it like only one JWT app is allowed per organisation? We have one JWT app created and don’t see the marketplace allows to create 2nd JWT app ? is this the case? Correct, only one JWT App can be created per organization since it has full access to most of the [Zoom APIs.](https://marketplace.zoom.us/docs/api-reference/zoom-api) Thanks, Tommy ---
**Author:** ![Dilip\_Reddy\_Guda](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@Dilip\_Reddy\_Guda](https://devforum.zoom.us/u/Dilip_Reddy_Guda)\ **Post date:** [July 2, 2020, 5:36am UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/11 "2020-07-02T05:36:53Z")
@tommy we had an issue with one of the OAuth app where in there were close to 11K refresh token calls were made in a span of one day (06/26). we would like to know if there any audit logs for this app to understand what was the response from Zoom when API calls were made. App name : MIM SURF Production How many tokens were issues for this app on 06/26 ? were there any error responses while refreshing the token related to this app? Regards Dilip ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 6, 2020, 6:00pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/12 "2020-07-06T18:00:59Z")
Hey @Dilip_Reddy_Guda, > [@Dilip\_Reddy\_Guda](#): > > were there any error responses while refreshing the token related to this app? Did you experience any errors? Can you clarify what the issue is? Thanks, Tommy ---
**Author:** ![Dilip\_Reddy\_Guda](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@Dilip\_Reddy\_Guda](https://devforum.zoom.us/u/Dilip_Reddy_Guda)\ **Post date:** [July 7, 2020, 1:43pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/13 "2020-07-07T13:43:54Z")
@tommy Yes we did run into an issue wherein ServiceNow platform trig erred abnormal number of token refresh requests (around 11K in a single day) we wanted to know, below details to understand the root cause of the issue (since we don’t have much logging on ServiceNow platform side for oAuth token refresh. Here ServiceNow is configured to refresh the OAuth token at regular intervals of 30 mins.) Things were working fine until we ran into the issue on 06/26. This caused the service now cripple as there were huge number of API token refresh requests sent to Zoom. App name : MIM SURF Production How many tokens were issues for this app on 06/26 ? were there any error responses while refreshing the token related to this app? to be very specific, was zoom responding with lesser expiry interval for API token refresh which resulted in huge requests on 06/26. Insights on Zoom app side would help identify the root cause. Regards Dilip ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 9, 2020, 9:23pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/14 "2020-07-09T21:23:17Z")
Hey @Dilip_Reddy_Guda, We are looking into our logs and will get back to you as soon as we can. (ZOOM-176069) Thanks, Tommy ---
**Author:** ![Dilip\_Reddy\_Guda](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@Dilip\_Reddy\_Guda](https://devforum.zoom.us/u/Dilip_Reddy_Guda)\ **Post date:** [July 10, 2020, 4:51am UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/15 "2020-07-10T04:51:46Z")
@tommy Thanks. would await response from your end. Let me know if you need any details from my end. Regards Dilip ---
**Author:** ![Dilip\_Reddy\_Guda](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@Dilip\_Reddy\_Guda](https://devforum.zoom.us/u/Dilip_Reddy_Guda)\ **Post date:** [July 13, 2020, 3:50pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/16 "2020-07-13T15:50:49Z")
@tommy Any update on the findings? Regards Dilip ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 15, 2020, 11:47pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/17 "2020-07-15T23:47:01Z")
Hey @Dilip_Reddy_Guda, No updates yet, I will let you know once I have one. Thanks for your patience, Tommy ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [July 16, 2020, 4:27pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/18 "2020-07-16T16:27:16Z")
Hey @Dilip_Reddy_Guda, Unfortunately we were not able to look into the issue until now, but the logs have expired on our end. Please let me know if you see this issue again and we will look into it right away. Thanks, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 10:43pm UTC](https://devforum.zoom.us/t/oauth-for-server-to-server/8354/19 "2020-08-21T22:43:56Z")
Closed on August 21, 2020, 10:43pm UTC