# Questions Regarding OAuth Tokens

**URL:** <https://devforum.zoom.us/t/questions-regarding-oauth-tokens/28591>\
**Category:** API and Webhooks\
**Created:** [August 31, 2020, 12:36am UTC](https://devforum.zoom.us/t/questions-regarding-oauth-tokens/28591 "2020-08-31T00:36:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![FacelessPhoenix](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@FacelessPhoenix](https://devforum.zoom.us/u/FacelessPhoenix)\
**Post date:** [August 31, 2020, 12:36am UTC](https://devforum.zoom.us/t/questions-regarding-oauth-tokens/28591/1 "2020-08-31T00:36:18Z")

</div>

I am fairly new to the whole authentication/authorization mechanism with OAuth APIs. The documentation says that refresh tokens are valid for 15 years and I don’t see a way to revoke them which makes me wonder about the security implications.

1. Is it possible to have more than one valid refresh token or does any subsequent generated token invalidate all previous?

2. What protections prevent misuse of a compromised refresh token if it doesn’t end up getting used by the application?

3. I believe the documentation also said that refresh tokens must be used for all subsequent access token requests, but what happens in the case where the refresh token is lost or you don’t have secured persistent memory? Would you go through the whole authorization process again?

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 31, 2020, 12:36am UTC](https://devforum.zoom.us/t/questions-regarding-oauth-tokens/28591/2 "2020-08-31T00:36:22Z")

</div>

Hey @FacelessPhoenix

Thanks for posting on the Zoom Devforum! I am still learning, but I will try my best to help answer your question. 🙂

Checkout this related thread that may have the answer you are looking for:

> [@Failed to find the refresh Token. The Token may be regenerated](https://devforum.zoom.us/t/-/1767):
>
> &nbsp; Hello, We have a Zoom integration through a Zoom marketplace app and we’re seeing some odd patterns regarding refresh tokens. We’re following the docs in&nbsp;[https://devdocs.zoom.us/docs/authorization/oauth-with-zoom](https://devdocs.zoom.us/docs/authorization/oauth-with-zoom) To summarize: At the end of the OAuth flow, Zoom provides us both an access and a refresh token. When the access token expires, we use the refresh token to get a new access and refresh token. We store both&nbsp;of them for the next requests. Everything works smoothly, the weird thin…

If this thread did not help, please let us know by replying back here and someone from the Developer Relations team will get back to you shortly.

Thanks,  
DeveloperBot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [September 30, 2020, 10:36am UTC](https://devforum.zoom.us/t/questions-regarding-oauth-tokens/28591/3 "2020-09-30T10:36:25Z")

</div>

Closed on September 30, 2020, 10:36am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.