# 400 Bad Request: Invalid authorization code

**URL:** <https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493>\
**Category:** Authentication\
**Created:** [April 15, 2025, 6:50am UTC](https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493 "2025-04-15T06:50:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dowow.tv](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dowow.tv/32/48366_2.png) [@dowow.tv](https://devforum.zoom.us/u/dowow.tv)\
**Post date:** [April 15, 2025, 6:50am UTC](https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493/1 "2025-04-15T06:50:28Z")

</div>

I’m trying to use Postman for testing my app following this [guide](https://developers.zoom.us/docs/integrations/oauth/). For code parameter I’m using the value from url after being redirected to the app after succesful authorization (url for authorization is copied from Local Test section on app setting page). The rest parameters are in place (including Authorization with Basic cliendID:ClientSecret Base 64 encoded). I’m using clientId and secret from Development Section (not production and the app is already published). But I’m getting the error:

```auto
{
    "reason": "Invalid authorization code",
    "error": "invalid_grant"
}

```

What’s happening? Is this authorization code one-time? I mean when autorization is complete in my app the backend part is already used this code for getting token for other needs. Does this mean that I can’t use same authorization code anymore? How does it work? Because sometime this POST call via Postman works, sometimes doesn’t - pretty inconsistant.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [April 16, 2025, 7:07pm UTC](https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493/2 "2025-04-16T19:07:23Z")

</div>

Hi @dowow.tv  
Thanks for reaching out to us!  
Here is a screenshot of my postman environment:

 ![Screenshot 2025-04-16 at 3.06.51 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/9/7/9793e02341575c3ba480f8543244e8811199ee80.png)

Just make sure to pass client id and client secret in your authorization tab.

---

<div class="post-metadata">

**Author:** ![dowow.tv](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dowow.tv/32/48366_2.png) [@dowow.tv](https://devforum.zoom.us/u/dowow.tv)\
**Post date:** [April 17, 2025, 5:51am UTC](https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493/3 "2025-04-17T05:51:19Z")

</div>

seems like you haven’t read my post carefully. All inputs are in place and I was asking about further authorization code usage after it was used for getting token in particular.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [April 17, 2025, 3:50pm UTC](https://devforum.zoom.us/t/400-bad-request-invalid-authorization-code/131493/4 "2025-04-17T15:50:56Z")

</div>

Hi @dowow.tv

> Is this authorization code one-time? Does this mean that I can’t use same authorization code anymore? How does it work? Because sometime this POST call via Postman works, sometimes doesn’t - pretty inconsistent.

Yes, the authorization code is only valid once.  
Once you use it to generate an access token, it will get invalidated. This is by design