# Refresh token not having tolerance when there is timeout **URL:** \ **Category:** Authentication\ **Created:** [March 12, 2024, 10:15am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552 "2024-03-12T10:15:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![seanbuffer](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/seanbuffer/32/57467_2.png) [@seanbuffer](https://devforum.zoom.us/u/seanbuffer)\ **Post date:** [March 12, 2024, 10:15am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/1 "2024-03-12T10:15:57Z")
1. Our App Details are: Client ID: hei16IV2SOqyRBVS5lFWlw App Name: CalDotComStaging 2. Zoom refresh token endpoint was consumed for some of our users with our zoom client id, zoom client secret, and their respective last valid refresh tokens. 3. For the ones that went through successfully, both the new refresh token returned and the previous refresh token were still able to be give a successful result when used to consume the refresh token endpoint again. Thus some tolerance observed 4. However, the one that timed out gave the perplexing result that it no longer allowed the last refresh token to give a successful result after that, rather it started given invalid\_token (i.e. invalid refresh token) as the reason for its failure. 5. Checking this link shows that this behavior has been observed by other Zoom OAuth api users: [How to refresh token if refresh\_token in incorrect - #19 by katyle](https://devforum.zoom.us/t/how-to-refresh-token-if-refresh-token-in-incorrect/3338/19) 6. The more worrisome issue is that there is that part of the temporary solution for the above where Zoom is talking about increasing the tolerance of refresh tokens, which basically means allowing stale refresh tokens to still be valid if their validity period hasn’t been exceeded, even if they are not the last generated, up to a particular threshold Zoom desires. However, (3) shows that the said tolerance has been implemented generally into the behavior of Zoom’s refresh token endpoints, whereas, (4) means that there’re still bugs left in that behavior. 7. Being that we have a case similar to 5, we need to be able to retry with the last token because of failure reasons like (4). A tolerance of 2 or 3 refresh token being valid concurrently will be highly appreciated, because when our clients need to book meetings, failure to get a successful refresh token is preventing us from generating their booking url in real time. Kindly treat as urgent. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [March 13, 2024, 3:03am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/2 "2024-03-13T03:03:59Z")
Hi @seanbuffer , I will put in a request for token tolerance increase for you. Can you please respond to my private message with the email address associated with your app? ---
**Author:** ![seanbuffer](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/seanbuffer/32/57467_2.png) [@seanbuffer](https://devforum.zoom.us/u/seanbuffer)\ **Post date:** [March 13, 2024, 4:44pm UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/4 "2024-03-13T16:44:17Z")
Hi @gianni.zoom, I’ve done that, thanks. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [March 14, 2024, 3:59am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/5 "2024-03-14T03:59:13Z")
Hi @seanbuffer , I’ve put in the request (ZSEE-109270). I’ll update you as needed 🙂 ---
**Author:** ![seanbuffer](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/seanbuffer/32/57467_2.png) [@seanbuffer](https://devforum.zoom.us/u/seanbuffer)\ **Post date:** [March 14, 2024, 6:47am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/6 "2024-03-14T06:47:35Z")
Noted with thanks @gianni.zoom. I’ll be on the lookout for your updates. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [March 19, 2024, 1:36am UTC](https://devforum.zoom.us/t/refresh-token-not-having-tolerance-when-there-is-timeout/105552/7 "2024-03-19T01:36:21Z")
Hi @seanbuffer , Please see below: > [@Zoom Refresh token invalidated when there is a timeout and app left in unusable state](https://devforum.zoom.us/t/zoom-refresh-token-invalidated-when-there-is-a-timeout-and-app-left-in-unusable-state/105680/7): > > Hi @systemProc @seanbuffer , I learned we don’t use token tolerance mechanism for OAuth apps now. A refresh token can be used to fetch a new access token and refresh token again and again until it expires after 90 days. The refresh token does not becomes invalid after it is used to fetch a new access token and new refresh token. The refresh token becomes invalid only in these three conditions: refresh tokens expired ( after 90 days) customer uninstalls the app customer reauthorized the app …