Questions Regarding OAuth Tokens

[FacelessPhoenix (Clayton)]

I am fairly new to the whole authentication/authorization mechanism with OAuth APIs. The documentation says that refresh tokens are valid for 15 years and I don’t see a way to revoke them which makes me wonder about the security implications.

1. Is it possible to have more than one valid refresh token or does any subsequent generated token invalidate all previous?

2. What protections prevent misuse of a compromised refresh token if it doesn’t end up getting used by the application?

3. I believe the documentation also said that refresh tokens must be used for all subsequent access token requests, but what happens in the case where the refresh token is lost or you don’t have secured persistent memory? Would you go through the whole authorization process again?

[DeveloperBot]

Hey @FacelessPhoenix

Thanks for posting on the Zoom Devforum! I am still learning, but I will try my best to help answer your question.

Checkout this related thread that may have the answer you are looking for:

Failed to find the refresh Token. The Token may be regenerated

  Hello, We have a Zoom integration through a Zoom marketplace app and we’re seeing some odd patterns regarding refresh tokens. We’re following the docs in https://devdocs.zoom.us/docs/authorization/oauth-with-zoom To summarize: At the end of the OAuth flow, Zoom provides us both an access and a refresh token. When the access token expires, we use the refresh token to get a new access and refresh token. We store both of them for the next requests. Everything works smoothly, the weird thin…

If this thread did not help, please let us know by replying back here and someone from the Developer Relations team will get back to you shortly.

Thanks,
DeveloperBot