# Understanding OAuth for Zoom **URL:** \ **Category:** API and Webhooks\ **Created:** [April 9, 2020, 8:17pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444 "2020-04-09T20:17:23Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![whatitis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/whatitis/32/5665_2.png) [@whatitis](https://devforum.zoom.us/u/whatitis)\ **Post date:** [April 9, 2020, 8:17pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/1 "2020-04-09T20:17:23Z")
**Description** I have a specific set of questions about OAuth for Zoom. **Which App Type (OAuth / Chatbot / JWT / Webhook)?** OAuth **Which Endpoint/s?** - `https://zoom.us/oauth/authorize` - `https://zoom.us/oauth/token` **Additional context** I’m in the process of writing a prototype batch application that needs to: - Authenticate/authorize to Zoom - Pull and process data I already have everything working correctly for [JWT](https://marketplace.zoom.us/docs/guides/auth/jwt), which is simple and straightforward. With JWT, I can run in batch and all is well. However, I am not sure I correctly understand how OAuth is supposed to work in this context. According to the documentation: - Step 1: Request User Authorization - GET `https://zoom.us/oauth/authorize` - Step 2: Request Access Token - POST `https://zoom.us/oauth/token` I’ve followed the directions and provided the appropriate query parameters for Step 1, but no matter what I try I’m not able to get this to work in batch. It _always_ requires a user to interactively log in (using a web browser), after which I’m issued an authorization code. This obviously will not work for a batch application. I need it to be programmatic, without user interaction. So far, my stop-gap for this prototype has been to: 1. Interactively log in to Zoom using `https://zoom.us/oauth/authorize?response_type=code&client_id=x&redirect_uri=https://foo.local` 2. Make a note of the authorization code that is issued 3. Provide that authorization code (as an environment variable) to my batch application 4. Let my batch application do the POST `https://zoom.us/oauth/token` using the authorization code from above 5. Batch application receives the access token 6. And so on… make more calls, get data, etc. Could someone help me understand what I’m missing? Should I be able to make a programmatic (read: no human involvement, no web browser) request to `https://zoom.us/oauth/authorize`? Or does it _always_ involve a human, by design? If it does always involve a human, then do the authorization codes expire? Thanks in advance for your help. ---
**Author:** ![whatitis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/whatitis/32/5665_2.png) [@whatitis](https://devforum.zoom.us/u/whatitis)\ **Post date:** [April 10, 2020, 4:37pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/2 "2020-04-10T16:37:38Z")
Replying to my own posting based on further trial-and-error and observation, along with information I found in this related thread: > [@Requesting Access Token via Python](https://devforum.zoom.us/t/requesting-access-token-via-python/6637): > > Description/Error I want to know how can i request access token for an OAuth App using Python. Do you have a template? I already have client-id and client-secret. I want to get access token now via Python script which I want to run locally on my machine. I can successfully generate the token by using "Send a Test Request " feature but now I am looking how to do it using python code. The OAuth for Zoom authentication process looks like: 1. Ask a human to visit your app’s `https://zoom.us/oauth/authorize?response_type=code&client_id=x&redirect_uri=https://foo.local` URI and authorize it. a. That human must have an account that can authorize the app b. S/he must use the web UI to do this step; it can _not_ be automated c. The result of this step is an **authorization code** 2. Use the **authorization code** provided by your human to do the POST `https://zoom.us/oauth/token` step a. After you do this step one time, the **authorization code** from step one is history (it won’t work again) b. The result of this step is a token set, consisting of an **access token** and a **refresh token** 3. Use the **access token** to call the Zoom API and pull data a. The **access token** expires after one hour b. The **refresh token** expires after fifteen years c. To get a new **access token** issue a request for a new one using the **refresh token** You will need a persistent area to hold on to the **access token** and (especially) the **refresh token**. If you lose the **refresh token** you will be starting over from step 1 above. My feeling at this point: if you need to authenticate in a batch process, use JWT if at all possible. The OAuth flow is an order of magnitude more complex. (Unfortunately, it appears using OAuth is the only way to limit access/scope for an account.) ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 11, 2020, 3:45am UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/3 "2020-04-11T03:45:18Z")
> [@whatitis](#): > > I’ve followed the directions and provided the appropriate query parameters for Step 1, but no matter what I try I’m not able to get this to work in batch. It _always_ requires a user to interactively log in (using a web browser), after which I’m issued an authorization code. That is correct. For Batch processes, use a [JWT Token](https://marketplace.zoom.us/docs/guides/auth/jwt). OAuth is meant for Zoom users to authorize your app to read/write on their behalf, for example, installing any app here: [http://marketplace.zoom.us/](http://marketplace.zoom.us/) Thanks, Tommy. ---
**Author:** ![whatitis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/whatitis/32/5665_2.png) [@whatitis](https://devforum.zoom.us/u/whatitis)\ **Post date:** [April 13, 2020, 2:57pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/4 "2020-04-13T14:57:09Z")
@tommy Thanks for clarifying. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 14, 2020, 6:51am UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/5 "2020-04-14T06:51:46Z")
Happy to help! 🙂 -Tommy ---
**Author:** ![sabraha5](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sabraha5](https://devforum.zoom.us/u/sabraha5)\ **Post date:** [May 10, 2020, 11:44pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/6 "2020-05-10T23:44:30Z")
i just created another new topic ([Longevity of OAuth UserManaged code](https://devforum.zoom.us/t/longevity-of-oauth-usermanaged-code/17014)) about the longevity of the **authorization code** and in reading this thread it seems it is only good for one use in getting an access/refresh token? do we need to request user for authorization again via the marketplace application Installation URL? thank you… ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 13, 2020, 10:15pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/7 "2020-05-13T22:15:22Z")
Hey @sabraha5, > [@sabraha5](#): > > it seems it is only good for one use in getting an access/refresh token? Correct. The code in the redirect url query param is just for getting an access and refresh token. You will never use that same code again, it does not need to be stored. > [@sabraha5](#): > > do we need to request user for authorization again via the marketplace application Installation URL? thank you… No, just simply [refresh the access token.](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing) Thanks, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 9:18pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/8 "2020-08-21T21:18:23Z")
Closed on August 21, 2020, 9:18pm UTC