Question about auth/refresh token on a unpublished app

I’ve built a frontend/backend solution to get a chat demo rolling using zoom’s api endpoints, and I’ve noticed that while it works great for one user, when a second developer in my company uses the test authentication link to use the demo system, the first user authentication token is now returning a {“code”:124,“message”:“invalid access token”} response. I’m storing the authentication tokens on the frontend, and passing them to my backend, then to zoom’s api, so it’s not like they’re being overwritten on the backend somehow.

Is this because I am using /me endpoints for user data instead of using /id/ endpoints? Or is this that since we’re all in the same company and they are using the test link, it falls under the purview of a single authentication at a time instance?

Hey @nb_et2,

Is this for a Chatbot? Chatbots are installed account wide so any of your users can use them.

Since Chatbots are account level apps, if they are “reinstalled” by another user, the previous tokens are invalidated.

What is your app name?

Thanks,
Tommy

Hey @tommy,

It’s actually an Oauth app, but it hasn’t been published yet. It simply uses the chat enpoints to facilitate chat, and meeting creation endpoints, etc.

Name is SelfStudy.

1 Like

Hey @nb_et2,

Gotcha! If you are using the same Zoom user in the flow you mentioned above, each time you re authorize the app, you will get a new set of tokens, invalidating the old ones.

Does that make sense?

Thanks,
Tommy