# Validating access JWT signature

**URL:** <https://devforum.zoom.us/t/validating-access-jwt-signature/83624>\
**Category:** Authentication\
**Tags:** jwt\
**Created:** [February 23, 2023, 11:49am UTC](https://devforum.zoom.us/t/validating-access-jwt-signature/83624 "2023-02-23T11:49:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![services2](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@services2](https://devforum.zoom.us/u/services2)\
**Post date:** [February 23, 2023, 11:49am UTC](https://devforum.zoom.us/t/validating-access-jwt-signature/83624/1 "2023-02-23T11:49:31Z")

</div>

Hello,

I was exploring the documentation at [https://marketplace.zoom.us/docs/guides/auth/oauth/#getting-an-access-token](https://marketplace.zoom.us/docs/guides/auth/oauth/#getting-an-access-token) and following the steps to get an OAuth application going.

However, I wasn’t able to find the way to verify the signature of the token - what’s the key used to sign the JWT? I assume it’s a shared secret rather than a key pair (but if I’m wrong, is there a public key the Zoom publishes?)

Thanks

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [February 23, 2023, 2:13pm UTC](https://devforum.zoom.us/t/validating-access-jwt-signature/83624/2 "2023-02-23T14:13:18Z")

</div>

Hi, @services2 ,

Thank you for posting in the Zoom Developer Forum. Can you share if you are looking to get started with Zoom Rest APIs or Zoom Meeting SDK?

Zoom Rest APIs use the access token and you do not need to validate the OAuth token.

# OAuth with Zoom

[https://marketplace.zoom.us/docs/guides/auth/oauth/](https://marketplace.zoom.us/docs/guides/auth/oauth/)

Zoom Meeting SDKs use an SDK JWT for authorization and you can verify the format of the signature with a tool [https://jwt.io/](https://jwt.io/)

# Authorization

[https://marketplace.zoom.us/docs/sdk/native-sdks/auth/](https://marketplace.zoom.us/docs/sdk/native-sdks/auth/)

---

<div class="post-metadata">

**Author:** ![services2](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@services2](https://devforum.zoom.us/u/services2)\
**Post date:** [February 23, 2023, 3:48pm UTC](https://devforum.zoom.us/t/validating-access-jwt-signature/83624/3 "2023-02-23T15:48:46Z")

</div>

Hi @donte.zoom

It’s Rest APIs.

I know we don’t need to validate the JWT but I would like to be able to - as a precaution since we’re storing the access token as well as refresh (ideally for the duration of its lifetime, but given our current implementation there are no guarantees about that) and on retrieval we would like to double check its integrity.

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [February 24, 2023, 1:37pm UTC](https://devforum.zoom.us/t/validating-access-jwt-signature/83624/4 "2023-02-24T13:37:31Z")

</div>

@services2.,

Can you share more details on the intended workflow? By default, the lifetime of an access token is 60 mins – so the validation will be handled on Zoom’s end. If any requests fail, the token is considered invalid, and the request will be rejected with `401 Unauthorized` result. At what point do you want to check to double-check its integrity? Or is there a specific edge case in your workflow that you are looking to avoid or control better?