# OAuth Redirect Issues **URL:** \ **Category:** Authentication\ **Tags:** api\ **Created:** [July 28, 2023, 6:02pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581 "2023-07-28T18:02:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Isaiah](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/isaiah/32/50627_2.png) [@Isaiah](https://devforum.zoom.us/u/Isaiah)\ **Post date:** [July 28, 2023, 6:02pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/1 "2023-07-28T18:02:19Z")
**OAuth Redirect Issues** _[OAuth for user authorized apps](https://developers.zoom.us/docs/integrations/oauth/)_ Since JWT is being deprecated I have been tasked with building an OAuth app to use in our system. We use the app to allow our clients in their own instances to manage their Zoom meetings, because of this there is a potentially infinite number of custom domains/subdomains that they could use. Ignoring the manual work of having someone go in and add each one of our clients domains (tens of thousands) I want to use the wildcard in the whitelist to accomplish this. Currently there are two major issues I have run into. 1. Our need is to have any number of clients with any number of completely unique domains and subdomains authorize their accounts through this app. I need a way to “whitelist” literally any domain that exists. This is not a nice to have, this is a must have. 2. With the redirect, I whitelisted my development environments url to test and it seems that the redirect trims off some necessary URI parameters from the provided url. This is also a blocker. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [July 28, 2023, 6:54pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/2 "2023-07-28T18:54:58Z")
Hi @Isaiah , Thank you for being a part of the Zoom Developer community! > [@Isaiah](#): > > Our need is to have any number of clients with any number of completely unique domains and subdomains authorize their accounts through this app. I need a way to “whitelist” literally any domain that exists. This is not a nice to have, this is a must have. This doesn’t sound possible at this time given that our security best practices and policy limits the auth to domains that are designated on the allow list. “Any number” is too arbitrary to work with our current logic. ![Screenshot 2023-07-28 at 2.28.11 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/3/c/3ce03929842011ac34147f1b6d488ca1120bac93.png) In order for your clients to authorize their accounts through this app, the redirect URLs on the OAuth allow list would need to have **the same base domain** : > **[OAuth for user authorized apps](https://developers.zoom.us/docs/zoom-rooms/oauth/#using-multiple-environments)** > > The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform. ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/2/e/2e58b358ead9b6c662f9a4578fe3795247e50dd8.png) What could help support this is [limiting the instal](https://developers.zoom.us/docs/distribute/app-submission/controlling-who-can-add-your-app/)l of your app by providing a “visit site to install” link. There, you could build authenticate your clients accordingly and allow them access to an authorization proxy (that satisfies the OAuth allow list requirements) to install the app. > [@Isaiah](#): > > 1. With the redirect, I whitelisted my development environments url to test and it seems that the redirect trims off some necessary URI parameters from the provided url. This is also a blocker. Can you please provide screenshots? I am not able to reproduce this. ---
**Author:** ![Isaiah](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/isaiah/32/50627_2.png) [@Isaiah](https://devforum.zoom.us/u/Isaiah)\ **Post date:** [August 2, 2023, 4:04pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/4 "2023-08-02T16:04:55Z")
Gianni, I have found some potential routes around the above mentioned issues. But I do have another question. Currently with JWT our clients can connect their accounts and then create a meeting, when creating the meeting they are able to choose who the host of the meeting is from the users in their Zoom account. Is there a way to do this with OAuth? I selected a user based app rather than an admin based because we will have many users accessing and using the integration. But we do need to have them select who will host. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [August 2, 2023, 4:13pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/5 "2023-08-02T16:13:53Z")
> [@Isaiah](#): > > Currently with JWT our clients can connect their accounts and then create a meeting, when creating the meeting they are able to choose who the host of the meeting is from the users in their Zoom account. Is there a way to do this with OAuth? Hi @Isaiah , Yes, but only if you enable the [scopes](https://developers.zoom.us/docs/integrations/oauth-scopes/) on the app that allow your app meeting creation privileges and that the users who install your app have those same permissions. For user-managed apps users " have access to Zoom APIs that manage an **individual** user’s content" In most instances, unless users have the permissions to create meetings on behalf of others where they can assign them as a host (typically developer or admin permission), they will not be able to do what you’ve described. ---
**Author:** ![Isaiah](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/isaiah/32/50627_2.png) [@Isaiah](https://devforum.zoom.us/u/Isaiah)\ **Post date:** [August 2, 2023, 5:47pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/6 "2023-08-02T17:47:38Z")
Thank you, To clarify, with the user scope they can do this, but the user who authenticates has to have the permissions themself? ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [August 8, 2023, 4:44pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/7 "2023-08-08T16:44:55Z")
Hi @Isaiah , > [@Isaiah](#): > > To clarify, with the user scope they can do this, but the user who authenticates has to have the permissions themself? Yes exactly. ---
**Author:** ![Isaiah](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/isaiah/32/50627_2.png) [@Isaiah](https://devforum.zoom.us/u/Isaiah)\ **Post date:** [August 8, 2023, 5:26pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/8 "2023-08-08T17:26:32Z")
Thank you Gianni, I built it to accommodate that and they only can view themselves in testing. That should work. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [August 10, 2023, 9:35pm UTC](https://devforum.zoom.us/t/oauth-redirect-issues/92581/9 "2023-08-10T21:35:58Z")
Okay great to hear! Thanks!