# Understanding OAuth for Zoom

**URL:** <https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444>\
**Category:** API and Webhooks\
**Created:** [April 9, 2020, 8:17pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444 "2020-04-09T20:17:23Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![whatitis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/whatitis/32/5665_2.png) [@whatitis](https://devforum.zoom.us/u/whatitis)\
**Post date:** [April 10, 2020, 4:37pm UTC](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444/2 "2020-04-10T16:37:38Z")

</div>

Replying to my own posting based on further trial-and-error and observation, along with information I found in this related thread:

> [@Requesting Access Token via Python](https://devforum.zoom.us/t/requesting-access-token-via-python/6637):
>
> Description/Error I want to know how can i request access token for an OAuth App using Python. Do you have a template? I already have client-id and client-secret. I want to get access token now via Python script which I want to run locally on my machine. I can successfully generate the token by using "Send a Test Request " feature but now I am looking how to do it using python code.

The OAuth for Zoom authentication process looks like:

1. Ask a human to visit your app’s `https://zoom.us/oauth/authorize?response_type=code&client_id=x&redirect_uri=https://foo.local` URI and authorize it.  
a. That human must have an account that can authorize the app  
b. S/he must use the web UI to do this step; it can _not_ be automated  
c. The result of this step is an **authorization code**
2. Use the **authorization code** provided by your human to do the POST `https://zoom.us/oauth/token` step  
a. After you do this step one time, the **authorization code** from step one is history (it won’t work again)  
b. The result of this step is a token set, consisting of an **access token** and a **refresh token**
3. Use the **access token** to call the Zoom API and pull data  
a. The **access token** expires after one hour  
b. The **refresh token** expires after fifteen years  
c. To get a new **access token** issue a request for a new one using the **refresh token**

You will need a persistent area to hold on to the **access token** and (especially) the **refresh token**. If you lose the **refresh token** you will be starting over from step 1 above.

My feeling at this point: if you need to authenticate in a batch process, use JWT if at all possible. The OAuth flow is an order of magnitude more complex. (Unfortunately, it appears using OAuth is the only way to limit access/scope for an account.)

---

_[View the full topic](https://devforum.zoom.us/t/understanding-oauth-for-zoom/12444)._