# Why Access Token Change Is Affecting JWT Apps?

**URL:** <https://devforum.zoom.us/t/why-access-token-change-is-affecting-jwt-apps/82840>\
**Category:** API and Webhooks\
**Created:** [February 9, 2023, 10:07am UTC](https://devforum.zoom.us/t/why-access-token-change-is-affecting-jwt-apps/82840 "2023-02-09T10:07:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bmartin](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@bmartin](https://devforum.zoom.us/u/bmartin)\
**Post date:** [February 9, 2023, 10:07am UTC](https://devforum.zoom.us/t/why-access-token-change-is-affecting-jwt-apps/82840/1 "2023-02-09T10:07:58Z")

</div>

I saw this today [https://devsupport.zoom.us/hc/en-us/articles/12363164278669-API-access-token-change](https://devsupport.zoom.us/hc/en-us/articles/12363164278669-API-access-token-change) and it says 👇

> ## **I use a JWT app. Does this affect me?**
> 
> Yes. The JWT app type ([which is being deprecated](https://marketplace.zoom.us/docs/guides/build/jwt-app/jwt-faq/)) generates an access token that is consumed by the Zoom API. This access token must be sent as part of the Authorization Request header as well.

I am using the JWT app but I am the above is misleading, the Zoom JWT app uses a JWT token not an access token. I am generating the JWT token using the API Key and API Secret, and then sending as 👇

```auto
{"Authorization", "Bearer #{jwt_token}"}, {"Content-Type", "application/json"}

```

In the header of each request.

**I am not sure what other changes will I need to make before the 24th of February 2023.**

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [February 9, 2023, 3:32pm UTC](https://devforum.zoom.us/t/why-access-token-change-is-affecting-jwt-apps/82840/2 "2023-02-09T15:32:11Z")

</div>

Looks like you’re already sending the token in the HTTP Authorization header, not as part of the URL query string, so you’re all set. This is about keeping authentication tokens out of URLs, which have a tendency to be stored unencrypted in log files by various servers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [February 13, 2024, 7:09am UTC](https://devforum.zoom.us/t/why-access-token-change-is-affecting-jwt-apps/82840/3 "2024-02-13T07:09:01Z")

</div>

Closed on February 13, 2024, 7:09am UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.