# "API hasn't passed marketplace verification" **URL:** \ **Category:** Zoom Apps\ **Created:** [August 18, 2022, 12:33pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483 "2022-08-18T12:33:05Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [August 18, 2022, 12:33pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/1 "2022-08-18T12:33:05Z")
**Zoom Apps Configuration** Vue 3, Vite 2 **Description** I would like to perform OAuth2 authentication, I guess, using `zoomSdk.authorize`. **Error?** `API hasn't passed marketplace verification.[error from web: code:40316, msg:'This api is not supported']` **Troubleshooting Routes** I [searched “API hasn’t passed marketplace verification” at Zoom Developer Support](https://devsupport.zoom.us/hc/en-us/search?utf8=%E2%9C%93&query=API+hasn%27t+passed+marketplace+verification). **How To Reproduce** - Create an app - Add the `zoomapp:inmeeting` scope - Start the app - Run `await zoomSdk.config({ capabilities: ['shareApp'] })` - Run `await zoomSdk.authorize()` * * * Thanks ---
**Author:** ![JonStewart](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonstewart/32/36192_2.png) [@JonStewart](https://devforum.zoom.us/u/JonStewart)\ **Post date:** [August 22, 2022, 11:28pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/2 "2022-08-22T23:28:51Z")
Hi Tiana. From your post, I’d suggest two things: First, in your [marketplace.zoom.us](http://marketplace.zoom.us) app build flow for this app, go to the Features tab, click on ‘Add APIs’ under the Zoom App SDK widget. Make sure the authorize API is checked on AND the onAuthorized event is checked on. Second, add these items to your capabilities list: ‘authorize’ and ‘onAuthorized’ ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [August 24, 2022, 8:16am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/3 "2022-08-24T08:16:09Z")
I wouldn’t have guessed OAuth-related methods would be disabled by default, I enabled those now. The `zoomSdk.promptAuthorize` now returns `{ message: 'Success' }` although nothing else happens. Calling `zoomSdk.onAuthorized` beforehand changes nothing and the callback is not fired. Also, I would like to have a try at `zoomSdk.promptAuthorize`, as I would prefer to avoid the PKCE thing, but that one returns the same initial error (`API hasn't passed marketplace verification`) despite I added the capability. Thanks ---
**Author:** ![JonStewart](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonstewart/32/36192_2.png) [@JonStewart](https://devforum.zoom.us/u/JonStewart)\ **Post date:** [August 24, 2022, 6:22pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/4 "2022-08-24T18:22:05Z")
Hi Tiana, promtAuthorize and authorize are not substitutes for each other; they do different things. promptAuthorize → use this when: 1. The user status (per the getUserContext status field) is ‘unauthenticated’, which means the user is not logged in to Zoom. This will prompt the user to log in to Zoom, and the sign in will be indicated with a onMyUserContextChange event. 2. The user status is ‘authenticated’, which means the user is logged in to Zoom, but has not ‘added’ the app. In this scenario, the method will take a user to the consent screen so they can add the app. After consenting, they will be returned to the App. Now, their user status will be ‘authorized’. authorize → use this when: 1. User status is ‘authorized’. This will kick off an OAuth 2.0 - based exchange. The first step is to listen for and receive an onAuthorized event. This event will include a code field; you can use this code then server-side to exchange for an access token for the Zoom Rest API. ---
**Author:** ![JonStewart](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonstewart/32/36192_2.png) [@JonStewart](https://devforum.zoom.us/u/JonStewart)\ **Post date:** [August 24, 2022, 6:39pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/5 "2022-08-24T18:39:24Z")
For more info: [Authentication](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication/) ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [August 26, 2022, 8:38am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/6 "2022-08-26T08:38:13Z")
> [@JonStewart](#): > > promptAuthorize […] will prompt the user to log in to Zoom [and/or] take a user to the consent screen I understand. > [@JonStewart](#): > > authorize […] will kick off an OAuth 2.0 - based exchange > [@JonStewart](#): > > For more info: [Authentication](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication/) The documentation you linked says : > Only PCKE method ‘plain’ is supported The [\ | @zoom/appssdk - v0.16.3](https://appssdk.zoom.us/modules/ZoomSdk._internal_.html#AuthorizeOptions) documentation says : > Only S256 encryption PKCE values are supported Which one is true ? Is it possible to avoid PKCE altogether ? If I understand correctly : ```js const CODE_CHALLENGE = require('crypto').createHash('sha256').update(CODE_VERIFIER).digest('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '') ``` For testing purposes, I set `CODE_VERIFIER = 'foo'` (`CODE_CHALLENGE = 'LCa0a2j_xo_5m0U8HTBBNBNCLXBkg7-g-YpeiGJm564'`), but keep getting `invalid_grant`. Thanks ---
**Author:** ![JonStewart](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonstewart/32/36192_2.png) [@JonStewart](https://devforum.zoom.us/u/JonStewart)\ **Post date:** [August 26, 2022, 9:01pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/7 "2022-08-26T21:01:46Z")
Apologies, the Authentication docs are outdated. SHA256 is required. I might try looking for an online tool to test your SHA256 code challenge implementation. There are many out there ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [August 29, 2022, 9:14am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/8 "2022-08-29T09:14:34Z")
Well, according to those tools (e.g. [this one](https://tonyxu-io.github.io/pkce-generator/) and [that one](https://example-app.com/pkce)), my code is right. I also tried generating strings directly from those tools, and still am getting `invalid_grant`. ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [September 1, 2022, 9:30am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/9 "2022-09-01T09:30:02Z")
Could I please have some help regarding that matter ? Thanks ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [September 5, 2022, 11:31am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/10 "2022-09-05T11:31:29Z")
@JonStewart Hello ?. ---
**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\ **Post date:** [September 6, 2022, 9:12pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/11 "2022-09-06T21:12:17Z")
Is your app based off our reference app? We recommend taking a look at 3rd party auth implementation within our reference app: [zoomapps-advancedsample-react/controller.js at main · zoom/zoomapps-advancedsample-react · GitHub](https://github.com/zoom/zoomapps-advancedsample-react/blob/main/backend/api/thirdpartyauth/controller.js) Your code challenge looks similar, but look through this sample app and see if altering implementations help? ---
**Author:** ![tianalemesle](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tianalemesle](https://devforum.zoom.us/u/tianalemesle)\ **Post date:** [September 7, 2022, 9:41am UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/12 "2022-09-07T09:41:37Z")
I’m developing an in-meeting app, so I’m using [`zoomSdk.authorize`](https://appssdk.zoom.us/classes/ZoomSdk.ZoomSdk.html#authorize) to get a code. Regarding getting a token : In the code you linked, payload is sent as `application/json` and client credentials are included in the payload (which returns `unsupported_grant_type` when testing). While in the [documentation](https://marketplace.zoom.us/docs/guides/auth/oauth/#step-2-request-access-token), payload is sent as `application/x-www-form-urlencoded` and client credentials are sent as BasicAuth (which returns `invalid_grant` when testing). So none work, but which one is supposed to ? Thanks. ---
**Author:** ![Joe.Yu](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Joe.Yu](https://devforum.zoom.us/u/Joe.Yu)\ **Post date:** [September 7, 2022, 6:30pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/13 "2022-09-07T18:30:01Z")
Hi @tianalemesle - I just tested our Reference app with authorization and it worked fine. Have you tried installing it and seeing how it works? Follow what’s currently in the Reference app, we are in the process of updating our docs so it may not be up to date. ---
**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\ **Post date:** [September 7, 2022, 6:31pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/14 "2022-09-07T18:31:09Z")
We tested our reference app using client version 5.12.0 (9832) and the latest CDN sdk version and found no errors with the Oauth. We **strongly** recommend using the reference app as a reference. Can you attempt to run the reference app to see if your errors are reproducible? Refer to this authorization page instead for Oauth within zoom apps: [Authentication](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication/) ---
**Author:** ![Joe.Yu](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Joe.Yu](https://devforum.zoom.us/u/Joe.Yu)\ **Post date:** [October 19, 2022, 7:01pm UTC](https://devforum.zoom.us/t/api-hasnt-passed-marketplace-verification/74483/15 "2022-10-19T19:01:11Z")
Hi @tianalemesle - have you tried using plain?