# Re-validation webhooks

**URL:** <https://devforum.zoom.us/t/re-validation-webhooks/86901>\
**Category:** API and Webhooks\
**Created:** [April 18, 2023, 11:43am UTC](https://devforum.zoom.us/t/re-validation-webhooks/86901 "2023-04-18T11:43:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![qatlvprod](https://avatars.discourse-cdn.com/v4/letter/q/b5e925/32.png) [@qatlvprod](https://devforum.zoom.us/u/qatlvprod)\
**Post date:** [April 18, 2023, 11:43am UTC](https://devforum.zoom.us/t/re-validation-webhooks/86901/1 "2023-04-18T11:43:43Z")

</div>

1. when receiving web-hook we get header \> authorization={verification token taken from ‘add features’}, this token will retire in October 2023. Does zoom plan on sending the secret instead? and if so, when?

2. according to: [https://developers.zoom.us/docs/api/rest/webhook-reference/#verify-webhook-events](https://developers.zoom.us/docs/api/rest/webhook-reference/#verify-webhook-events)

we should take timestamp:requestBody and hash those with the secret from ‘add features’ tab and compare to `x-zm-signature` header. how do you propose to implement this? on firewall/load balancer level or application level?

1. is it enough to check authorization header?

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [April 19, 2023, 6:39pm UTC](https://devforum.zoom.us/t/re-validation-webhooks/86901/2 "2023-04-19T18:39:33Z")

</div>

Hi @qatlvprod  
Thanks for reaching out to us, I am happy to help here!  
Yes, we are retiring the verification token later this year and the secret token will be used as the authorization method.

Here is a sample app that you can use to understand how to implement this on your application:

> **[GitHub - zoom/webhook-sample: Receive Zoom webhooks.](https://github.com/zoom/webhook-sample)**
>
> Receive Zoom webhooks. Contribute to zoom/webhook-sample development by creating an account on GitHub.

This is application level since every app comes with its own secret token

Hope this helps!  
Elisa

---

<div class="post-metadata">

**Author:** ![qatlvprod](https://avatars.discourse-cdn.com/v4/letter/q/b5e925/32.png) [@qatlvprod](https://devforum.zoom.us/u/qatlvprod)\
**Post date:** [April 23, 2023, 7:11am UTC](https://devforum.zoom.us/t/re-validation-webhooks/86901/3 "2023-04-23T07:11:33Z")

</div>

thanks 🙂 ill take a look and let you know

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [April 25, 2024, 10:48pm UTC](https://devforum.zoom.us/t/re-validation-webhooks/86901/4 "2024-04-25T22:48:04Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.