# Question about auth/refresh token on a unpublished app

**URL:** <https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476>\
**Category:** API and Webhooks\
**Created:** [April 22, 2020, 6:31pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476 "2020-04-22T18:31:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nb\_et2](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nb_et2/32/6583_2.png) [@nb\_et2](https://devforum.zoom.us/u/nb_et2)\
**Post date:** [April 22, 2020, 6:31pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476/1 "2020-04-22T18:31:13Z")

</div>

I’ve built a frontend/backend solution to get a chat demo rolling using zoom’s api endpoints, and I’ve noticed that while it works great for one user, when a second developer in my company uses the test authentication link to use the demo system, the first user authentication token is now returning a {“code”:124,“message”:“invalid access token”} response. I’m storing the authentication tokens on the frontend, and passing them to my backend, then to zoom’s api, so it’s not like they’re being overwritten on the backend somehow.

Is this because I am using /me endpoints for user data instead of using /id/ endpoints? Or is this that since we’re all in the same company and they are using the test link, it falls under the purview of a single authentication at a time instance?

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 23, 2020, 8:07pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476/2 "2020-04-23T20:07:47Z")

</div>

Hey @nb_et2,

Is this for a Chatbot? Chatbots are installed account wide so any of your users can use them.

Since Chatbots are account level apps, if they are “reinstalled” by another user, the previous tokens are invalidated.

What is your app name?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![nb\_et2](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nb_et2/32/6583_2.png) [@nb\_et2](https://devforum.zoom.us/u/nb_et2)\
**Post date:** [April 24, 2020, 8:15pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476/3 "2020-04-24T20:15:08Z")

</div>

Hey @tommy,

It’s actually an Oauth app, but it hasn’t been published yet. It simply uses the chat enpoints to facilitate chat, and meeting creation endpoints, etc.

Name is SelfStudy.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 28, 2020, 4:31pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476/4 "2020-04-28T16:31:59Z")

</div>

Hey @nb_et2,

Gotcha! If you are using the same Zoom user in the flow you mentioned above, each time you re authorize the app, you will get a new set of tokens, invalidating the old ones.

Does that make sense?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 8:57pm UTC](https://devforum.zoom.us/t/question-about-auth-refresh-token-on-a-unpublished-app/14476/5 "2020-08-21T20:57:24Z")

</div>

Closed on August 21, 2020, 8:57pm UTC