# Secret Token Change - Zoom Apps Deauthorization Notification

**URL:** <https://devforum.zoom.us/t/secret-token-change-zoom-apps-deauthorization-notification/93992>\
**Category:** API and Webhooks\
**Created:** [August 25, 2023, 5:57pm UTC](https://devforum.zoom.us/t/secret-token-change-zoom-apps-deauthorization-notification/93992 "2023-08-25T17:57:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dom.fernandez](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@dom.fernandez](https://devforum.zoom.us/u/dom.fernandez)\
**Post date:** [August 25, 2023, 5:57pm UTC](https://devforum.zoom.us/t/secret-token-change-zoom-apps-deauthorization-notification/93992/1 "2023-08-25T17:57:07Z")

</div>

###Secret Token Change - Zoom Apps Deauthorization Notification

**Description**

Our Zoom app has an endpoint configured for our app’s Deauthorization Notification ([Deauthorization](https://developers.zoom.us/docs/platform/auth/deauthorization/)).

We are currently using our app’s Verification Token to verify that requests coming to this endpoint are from Zoom. However, Zoom is retiring the usage of this Verification Token in October, and pivoting to using the Secret Token.

Our Zoom app does not yet have a Secret Token generated. We need to press the **Generate** button to obtain it.

Before we generate the Secret Token and change our endpoint to verify incoming requests using this Secret Token, we want to ask:

- If we press the **Generate** button to obtain the Secret Token, will it stop sending the Verification Token to our Deauthorize Notification endpoint?
- When the Verification Token expires, do we have to follow the HMAC SHA-256 hashing in our Deauthorization Notification endpoint as specified here ([Using webhooks](https://developers.zoom.us/docs/api/rest/webhook-reference/#verify-with-zooms-header)) to verify that the request came from Zoom?

---

<div class="post-metadata">

**Author:** ![ojus.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ojus.zoom/32/734_2.png) [@ojus.zoom](https://devforum.zoom.us/u/ojus.zoom)\
**Post date:** [September 8, 2023, 10:28pm UTC](https://devforum.zoom.us/t/secret-token-change-zoom-apps-deauthorization-notification/93992/2 "2023-09-08T22:28:28Z")

</div>

Hi @dom.fernandez

You dont need to validate the deauthorization endpoint. And after october the secret token will replace the verification token.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [September 11, 2024, 2:04pm UTC](https://devforum.zoom.us/t/secret-token-change-zoom-apps-deauthorization-notification/93992/3 "2024-09-11T14:04:53Z")

</div>

Closed on September 11, 2024, 2:04pm UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.