# App approval and url verification **URL:** \ **Category:** API and Webhooks\ **Created:** [April 15, 2025, 4:11pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516 "2025-04-15T16:11:56Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 15, 2025, 4:11pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/1 "2025-04-15T16:11:56Z")
We are in process of approval. We gather all required documentations and trying to submit the app for approval. Running into few issues: 1. Trying to validate oauth-callback endpoint. Getting “URL validation failed. Try again later”. In my logs I see Zoom is trying to send a message “{“payload”:{“plainToken”:“OWEIQRXcR-O730meXbC4Eg”},“event\_ts”:1744729362254,“event”:“endpoint.url\_validation”}” and in my code I am returning OK(); Strange thing is that when I use ngrok link to same code then Zoom approves the verification when I point to dev server to exactly same code then it fails. Any ideas? 2. Also, I have requested from Zoom temporary Share of the app outside our organization that was granted until 05/13/2025. When I try to accept the app outside of the organization I am getting a temporary code that I been using exactly same way inside our organization to swap for access token and it fails now. I tried using dev and prod ClientId/secret to[[https://zoom.us/oauth/token](https://zoom.us/oauth/token)] with “grant\_type”: “authorization\_code” and “code”:”temp\_code\_obtained\_from\_zoom” and getting : { reason": “Invalid authorization code”, “error”: “invalid\_grant” }. Inside our organization swapping temp code access token works without any issue. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 16, 2025, 11:41pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/2 "2025-04-16T23:41:58Z")
Hi @Sebastian3 Thanks for reaching out to us! For the first issue, are you not able to validate your Event notification endpoint URL in your production environment? Can you confirm if you are receiving the payload in your endpoint? if so, I will like to take a closer look into this ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 17, 2025, 2:30pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/3 "2025-04-17T14:30:30Z")
Elisa, For the first issue I figured out. The way i was converting to Hex format was not accepted by Zoom. Finally this way worked for me and zoom approved it: `return BitConverter.ToString(hash).Replace("-", "").ToLower();` I am still having issue with item #2. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 17, 2025, 3:48pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/4 "2025-04-17T15:48:39Z")
Hi @Sebastian3 Happy to hear you were able to fix the first issue. For the second one, was the temporary code working with no issues for dev and prod in the past? ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 17, 2025, 5:28pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/5 "2025-04-17T17:28:17Z")
Elisa, temporary code only works in Dev, Never worked in Prod. Do i need to do anything different in Prod vs Dev? ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 17, 2025, 5:54pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/6 "2025-04-17T17:54:49Z")
Elisa, I am using following call in curl or postman as well in code using DEV information and i get access token/refresh token back that i use to create a Zoom meeting ```auto curl --request POST "https://zoom.us/oauth/token" \ --user "{Dev Client Id}:{Dev Client Secret}" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=authorization_code" \ --data-urlencode "code={temporaryCode}" ``` ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 17, 2025, 7:58pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/7 "2025-04-17T19:58:15Z")
Elisa, Slight correction. It does work in Prod within our organization however does not work in “Share App” with “Authorization URL” that we been approved by Zoom until 05/13 that we are trying to use with another organization. The temporary code we getting results in `{"reason":"Invalid authorization code","error":"invalid_grant"}` ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 17, 2025, 8:46pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/8 "2025-04-17T20:46:43Z")
Thanks @Sebastian3 Let me reach out to the Marketplace team about this ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 1:26pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/9 "2025-04-18T13:26:22Z")
Thank you. How long does it take to hear back from that team? Any advice will be appreciated. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 18, 2025, 2:10pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/10 "2025-04-18T14:10:22Z")
I will try to get you an answer today ---
**Author:** ![kwaku.nyante](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kwaku.nyante/32/23475_2.png) [@kwaku.nyante](https://devforum.zoom.us/u/kwaku.nyante)\ **Post date:** [April 18, 2025, 2:25pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/11 "2025-04-18T14:25:18Z")
Hey @Sebastian3, can I get the name of the app so I can take a look and see what’s going on? Regards, Kwaku ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 2:32pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/12 "2025-04-18T14:32:53Z")
> [@kwaku.nyante](#): > > Kwaku Kwaku, General App (Account Level) - " Andor Health App" Sebastian ---
**Author:** ![kwaku.nyante](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kwaku.nyante/32/23475_2.png) [@kwaku.nyante](https://devforum.zoom.us/u/kwaku.nyante)\ **Post date:** [April 18, 2025, 3:33pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/13 "2025-04-18T15:33:27Z")
Hello @Sebastian3 Authorization URL’s only give the Production credentials the ability for external installs not the Dev credentials, these can only be used internally within your Zoom account and at the moment we do not have a way to use those credentials externally. Regards, Kwaku ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 3:56pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/14 "2025-04-18T15:56:59Z")
Kwaku, I am using Production credentials in “Zoom Production” environment within my organization and that works. I am trying. to test our app outside our organization by sharing the url with our client by giving the client the Shared App link that was approved by zoom . Are you telling me this will not work? If not, then how possibly can i test the App before I publish to app marketplace? Sebastian ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 4:03pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/15 "2025-04-18T16:03:03Z")
Kwaku, Is it possible to get on a call for like 10-15 minutes to resolve this? Sebastian ---
**Author:** ![kwaku.nyante](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kwaku.nyante/32/23475_2.png) [@kwaku.nyante](https://devforum.zoom.us/u/kwaku.nyante)\ **Post date:** [April 18, 2025, 4:16pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/16 "2025-04-18T16:16:40Z")
I just regenerated the url, and gave it a try it does work as long as the external account installing the app has the correct role. Can you provide the error the external customers are receiving? I attached the error I receive but this is because I don’t have the required role. But it doesn’t give me an error in relation to my account being unable to install the app. ![Screenshot 2025-04-18 at 11.14.41 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/c/f/cfd0cb280be45b236c2c40709fedd429de972cf3.png) ---
**Author:** ![kwaku.nyante](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kwaku.nyante/32/23475_2.png) [@kwaku.nyante](https://devforum.zoom.us/u/kwaku.nyante)\ **Post date:** [April 18, 2025, 4:18pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/17 "2025-04-18T16:18:17Z")
You can also make those Master scopes optional so that it doesn’t prevent most accounts from installing. Most users even admins do not have access to Sub account scopes Regard,s Kwaku ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 4:26pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/18 "2025-04-18T16:26:30Z")
> [@kwaku.nyante](#): > > Most users even admins do not have access to Sub account scopes When I provide my client with the Share App link they do see the valid screen: ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/8/a/8ac1c4431fd274f250c654f5574d0a2603f6a7dc.png) As soon as the client(ouside my organization) clicks Allow, I am getting a callback with temporary code that I am trying to swap for access token/refresh token by calling ```auto curl --request POST "https://zoom.us/oauth/token" \ --user "{Prod Client Id}:{Prod Client Secret}" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=authorization_code" \ --data-urlencode "code={temporaryCode}" \ --data-urlencode "redirect_uri={redirect_uri whitelisted on zoom}" ``` However I am getting this in response. `{"reason":"Invalid authorization code","error":"invalid_grant"}` When i try exact same Prod credentials and same call with a user within my organization then it works fine. ---
**Author:** ![kwaku.nyante](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/kwaku.nyante/32/23475_2.png) [@kwaku.nyante](https://devforum.zoom.us/u/kwaku.nyante)\ **Post date:** [April 18, 2025, 6:16pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/20 "2025-04-18T18:16:00Z")
Hello, Yeah, I am not sure, but you cannot use the internal account to justify it working, it will work internally even if the Authorization URL was not approved. Do you have another account you can use? There might be a limitation on the account. I just tried with one of our Zoom test accounts and I received this [https://dev-apim.andor.app/api/virtual-health/zoom/oauth-callback?code=ouJO5vcAPKsI8t4XsAZTcGkrDY92uu-Ag](https://dev-apim.andor.app/api/virtual-health/zoom/oauth-callback?code=ouJO5vcAPKsI8t4XsAZTcGkrDY92uu-Ag) Regards, Kwaku ---
**Author:** ![Sebastian3](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Sebastian3](https://devforum.zoom.us/u/Sebastian3)\ **Post date:** [April 18, 2025, 6:31pm UTC](https://devforum.zoom.us/t/app-approval-and-url-verification/131516/21 "2025-04-18T18:31:02Z")
Correct, you will get that and on the backend I am getting a callback triggered by zoom with a temporary code that fails to be swapped for access token/refresh token. It only works when you are logged in with an account that is inside Andor organization. I have couple of paid Pro accounts not affiliated with each other. Should this work? What is the purpose of the Share App link then? ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/1/5/153071a4873011eb3afcf6dfa9c903197147f565.png) [Next page](https://devforum.zoom.us/t/app-approval-and-url-verification/131516.md?page=2)