# OAuth with ZOOM Rest API from iOS

**URL:** <https://devforum.zoom.us/t/oauth-with-zoom-rest-api-from-ios/23937>\
**Category:** API and Webhooks\
**Tags:** faq-ios\
**Created:** [July 13, 2020, 2:56am UTC](https://devforum.zoom.us/t/oauth-with-zoom-rest-api-from-ios/23937 "2020-07-13T02:56:03Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [July 21, 2020, 4:34pm UTC](https://devforum.zoom.us/t/oauth-with-zoom-rest-api-from-ios/23937/4 "2020-07-21T16:34:49Z")

</div>

Hey @spoulose,

> [@spoulose](#):
>
> However this is no more a problem as we have a https server URL used as OAuth redirect URI and server will call our app’s custom URL.

This is the correct flow. 🙂

> [@spoulose](#):
>
> Our main concern is related to Security.Since we integrate Zoom OAuth with iOS app, the client secret has to reside in application and it is not a recommenced way it seems.  
> [Zoom documentation](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing) suggest to set ClientID:ClientSecret in Authorisation header while requesting token.

The Client Secret and request to [get an access token](https://marketplace.zoom.us/docs/guides/auth/oauth) should not be made on the frontend. After landing on the redirect url, you should send the code in the query param to your backend server to make the [get access token request](https://marketplace.zoom.us/docs/guides/auth/oauth), and then send the access token to your frontend in your session or however you want to use it. The Client Secret should never touch your frontend application.

Does that make sense?

Thanks,  
Tommy

---

_[View the full topic](https://devforum.zoom.us/t/oauth-with-zoom-rest-api-from-ios/23937)._