# Server-to-Server OAuth: annoying token-invalidation

**URL:** <https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070>\
**Category:** Authentication\
**Created:** [July 12, 2022, 11:00am UTC](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070 "2022-07-12T11:00:01Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [April 5, 2023, 10:38pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070/13 "2023-04-05T22:38:26Z")

</div>

You’ll want to design a [key rotation](https://devforum.zoom.us/t/refresh-token-workflow-for-multi-tenant-apps/79405/2) system — we use a shared database that acts as a synchronization primitive to decide on a race condition winner process that [renews the token for the inactive slot well in advance](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432/15), then swaps that slot into active use for everyone in the same environment. You’ll need to create duplicate applications (each application counts as one slot) or contact Developer Support to increase your token index limit.

---

_[View the full topic](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070)._