# Question regarding OAuth authorization and subsequent calls **URL:** \ **Category:** API and Webhooks\ **Created:** [March 23, 2022, 1:27am UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265 "2022-03-23T01:27:14Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jfuhr](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jfuhr](https://devforum.zoom.us/u/jfuhr)\ **Post date:** [March 23, 2022, 1:27am UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/1 "2022-03-23T01:27:14Z")
I am creating an OAuth2 app to allow our customer to grant access to their Zoom account for creating meetings. Authorization is done at the Account level. When the authorization code is returned via the Redirect page, can that token code be stored and used on all calls indefinitely? My initial tests seem to indicate that the user has to grant access every time a call is made. My end goal is this: 1. User logs into my application and clicks a button to Authorize the integration. 2. User is taken to the Zoom authorization page and authorizes. 3. User is sent to the Redirect URL with the access code. 4. Access code is stored locally and used to call the server forever. 5. The next time the user logs into my application, it knows authorization has already been granted and the stored code is used to make zoom calls. I don’t want my user to have to authorize access every time they log into my application. Is that possible? ---
**Author:** ![jfuhr](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jfuhr](https://devforum.zoom.us/u/jfuhr)\ **Post date:** [March 23, 2022, 3:25pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/3 "2022-03-23T15:25:39Z")
Additional testing shows that Authorization codes are one-time use. Is this true? Here is how I tested this with my developer account: 1. Called [https://zoom.us/oauth/authorize?response\_type=code&client\_id=](https://zoom.us/oauth/authorize?response_type=code&client_id=)(my key)&redirect\_uri=https://localhost:44357/ZoomHandler.ashx 2. Got the authorization code 3. In Postman, called [https://zoom.us/oauth/token?code=](https://zoom.us/oauth/token?code=)(code from step 2)&grant\_type=authorization\_code&redirect\_uri=https://localhost:44357/ZoomHandler.ashx 4. Got back response body with access\_token and refresh\_token, etc. 5. Repeated step 3. 6. Got 400 Bad Request with JSON `{ "reason": "Invalid authorization code", "error": "invalid_grant" }` ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [March 23, 2022, 4:35pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/4 "2022-03-23T16:35:50Z")
My understanding is the authorization code is one-use. You need to exchange that for an access token for something that can be reused; for details, see “Step 2: Request Access Token” in [OAuth with Zoom](https://marketplace.zoom.us/docs/api-reference/using-zoom-apis#authorization-code). While you’re there, note that the intention is to eventually make Proof Key for Code Exchange (PKCE) a requirement, but it is currently [on hold due to interoperability concerns](https://devforum.zoom.us/t/zoom-oauth-2-0-proof-key-for-code-exchange-pkce-flow/63830). ---
**Author:** ![jfuhr](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jfuhr](https://devforum.zoom.us/u/jfuhr)\ **Post date:** [March 23, 2022, 4:43pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/5 "2022-03-23T16:43:47Z")
Thanks. So if understand correctly, once you have the Access Token, it can be used until the user revoke’s that application’s access? The only requirement being that the token expires after one hour so it has to be renewed? I want my user to be able to approve the integration once and then it’s good until they revoke. ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [March 23, 2022, 4:49pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/6 "2022-03-23T16:49:44Z")
That’s my understanding; note that refresh tokens expire in 15 years according to “Refreshing an Access Token” in [OAuth with Zoom](https://marketplace.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token). ---
**Author:** ![jfuhr](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jfuhr](https://devforum.zoom.us/u/jfuhr)\ **Post date:** [March 23, 2022, 4:55pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/7 "2022-03-23T16:55:15Z")
Ah, I missed the part about it being valid for 15 years. Makes complete sense now. Probably better terminology is needed. Refresh, to me, means that it has to be renewed on every call. Thanks for the help, I think I can continue now 😄 ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [March 30, 2022, 3:26am UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/8 "2022-03-30T03:26:30Z")
Thanks for sharing your insight @MultiplayerSession! Your contributions are appreciated. Best, Donte ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [April 29, 2022, 1:26pm UTC](https://devforum.zoom.us/t/question-regarding-oauth-authorization-and-subsequent-calls/66265/9 "2022-04-29T13:26:33Z")
Closed on April 29, 2022, 1:26pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.