# Refresh token issue in multi-tenant environment

**URL:** <https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208>\
**Category:** API and Webhooks\
**Created:** [May 27, 2020, 7:32am UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208 "2020-05-27T07:32:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![miroslav.grozdanovsk](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@miroslav.grozdanovsk](https://devforum.zoom.us/u/miroslav.grozdanovsk)\
**Post date:** [May 27, 2020, 7:32am UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208/1 "2020-05-27T07:32:09Z")

</div>

Hello,

We are experiencing an issue with how the refresh token works in our multi-tenant app, explained below.

We have multi-tenant support in our application, so a given user (with email A) can have accounts in both Tenant1 and Tenant2, which are totally isolated environments (with different login credentials). This means that if the user wants to connect our app to his Zoom account, he will repeat the OAuth flow twice, once for each tenant.

The problem here is that once he completes the OAuth flow on the second tenant, he gets a new refresh token, which invalidates the previous refresh token that was created for the first tenant (stored separately).

How can we go around this issue?

One possible fix would be to store the ZoomUserId beside the refresh token, and when a new refresh token is generated, we update all DB records for that ZoomUserId.  
Does that make sense or there are other alternatives?  
Also this wouldn’t be that easy if we end up storing different tenant info in different databases, which we eventually plan to do so.

Thank you,  
Miroslav

---

<div class="post-metadata">

**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\
**Post date:** [May 29, 2020, 6:51am UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208/2 "2020-05-29T06:51:02Z")

</div>

Hi @miroslav.grozdanovsk, your suggestion is the only solution I can currently imagine given the requirements of the single refresh\_token per userId. We are working on providing greater flexibility for multi-tenant OAuth, but this is our current suggestion.

---

<div class="post-metadata">

**Author:** ![miroslav.grozdanovsk](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@miroslav.grozdanovsk](https://devforum.zoom.us/u/miroslav.grozdanovsk)\
**Post date:** [May 30, 2020, 7:39pm UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208/3 "2020-05-30T19:39:41Z")

</div>

Hi @michael.zoom,

Do you have any rough estimation of when you will complete those changes and provide that flexibility?  
If it’s soon, it may affect the development plans on our side.

Thank you,  
Miroslav

---

<div class="post-metadata">

**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\
**Post date:** [June 1, 2020, 2:58pm UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208/4 "2020-06-01T14:58:49Z")

</div>

Hi @miroslav.grozdanovsk I do not believe this on our short term roadmap. The Marketplace team is prioritizing user privacy & security reviews at this time.

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 9:38pm UTC](https://devforum.zoom.us/t/refresh-token-issue-in-multi-tenant-environment/19208/5 "2020-08-21T21:38:24Z")

</div>