# OAuth2 Considerations in Desktop Application

**URL:** <https://devforum.zoom.us/t/oauth2-considerations-in-desktop-application/69199>\
**Category:** API and Webhooks\
**Created:** [May 19, 2022, 12:27am UTC](https://devforum.zoom.us/t/oauth2-considerations-in-desktop-application/69199 "2022-05-19T00:27:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![svoid](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/svoid/32/37817_2.png) [@svoid](https://devforum.zoom.us/u/svoid)\
**Post date:** [May 19, 2022, 12:27am UTC](https://devforum.zoom.us/t/oauth2-considerations-in-desktop-application/69199/1 "2022-05-19T00:27:10Z")

</div>

I’m implementing a Zoom integration in a Desktop application that needs to invoke a couple of ReST API’s for meetings (Get/Create/Modify/Delete). In order to get an OAuth2 access token, I need to specify my client\_secret as a Base64 encoded Authorization header. In this publicly available desktop application there is no way to guarantee the security of a client\_secret embedded in my code. According to the documentation, this seems to be required whether or not I’m using PKCE. Is there some other way to accomplish this that does not require embedded a client\_secret in my application? Or do people just generally accept that the Zoom OAuth2 client\_secret is not really a secret?

Given that my desktop application does not have a corresponding web backend, I don’t really have a valid https URL for an OAuth2 redirect\_uri. It doesn’t really matter for my application considering that my embedded browser intercepts the redirect and just extracts the needed information. However, I’m curious to know if Zoom has any recommendations here for desktop applications. I’ve seem some applications use something like [https://localhost/oauth2/redirect](https://localhost/oauth2/redirect) or a custom URI scheme like myapp://oauth2/redirect. Any advice on a preferred approach?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [June 18, 2022, 10:27am UTC](https://devforum.zoom.us/t/oauth2-considerations-in-desktop-application/69199/2 "2022-06-18T10:27:14Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.