PKCE OAuth doesn't support multiple concurrent sign ins

API and Webhooks
1

Format Your New Topic as Follows:

API Endpoint(s) and/or Zoom API Event(s)
PKCE OAuth

Description
We’re switching from server-to-server to PKCE OAuth as advised during a period security review by Zoom. We’re able to use PKCE OAuth, but if two devices sign in to the same client ID, the second device invalidates the first device’s access token.

We have two different client IDs, one for our Mac app and one for our iOS app. Our iOS app registration is working with multiple concurrent device sign ins, but our Mac app registration isn’t.

Is there some sort of setting on Zoom’s end that controls which apps are allowed to have multiple concurrent access tokens? Is there any documentation describing how many concurrent access tokens are allowed? We don’t want to rely on multiple access tokens and then find out there’s a limit that causes problems for users with multiple devices.

According to Multiple access Token support available for server-to-server apps, server-to-server auth now supports multiple access tokens, so I’d expect PKCE OAuth to support the same.

We only have 30 days to remediate this according to the Zoom security review, so any assistance would be appreciated.

How To Reproduce
Steps to reproduce the behavior:

  1. Sign in with PKCE OAuth using our client ID for our iOS app on one device
  2. Sign in with PKCE OAuth using our client ID for our iOS app on a second device
  3. Both OAuth access tokens stay valid
  4. Sign in with PKCE OAuth using our client ID for our Mac app on one Mac
  5. Sign in with PKCE OAuth using our client ID for our Mac app on a second Mac
  6. The first access token is invalidated

Similar older reports, but for server-to-server auth:

2

Hi Kent! Just wanted to let you know that we’re looking into this on the Zoom side. We should have an answer for you soon, apologies for the wait on this one.

3

Checking to see if you have an update on this.

The main thing we’d like to know is if there’s a specific limit on the number of concurrent access tokens.

Thank you!

4

Hello @Kent_Sutherland

We are taking a look at this and should have an update for you soon.
Thank you for your continued patience.

Best,
Yoon

6

Hi @Kent_Sutherland,

Nice to e-meet you! Thank you for your patience. We have updated our system to enable support for multiple access tokens in your Mac application. Kindly verify these changes on your side and let us know if everything is working correctly. Additionally, there are no restrictions on the number of concurrent access tokens at this time.

Best regards,
Chad

1 Like
7

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.