Beta Test authorization URL does not include newly added scopes — how to test new scopes with external users?

App Marketplace
1

Hi,
We have a published OAuth app (Meeting SDK) and we recently added a new scope (user:read:token) to implement OBF tokens. We want to test this new scope with an external Zoom account before submitting the app for re-review.
What we tried:

image
image1656×302 31.9 KB

1. Local Test (Development tab): The development credentials have the new scope and it works — we can successfully call GET /v2/users/{userId}/token?type=onbehalf using tokens issued via the dev app. However, Local Test only works within our own Zoom account. External users cannot authorize the development app.

image
image1660×278 31.3 KB

2. Beta Test (Production tab): We copied the Beta Test authorization URL and had an external user authorize successfully. However, the access token issued does not include the new user:read:token scope. When we call the OBF token endpoint with this token, we get:
{“code”:4711,“message”:“Invalid access token, does not contain scopes:[user:read:token, user:read:token:admin].”}

3. It appears the Beta Test authorization URL only issues tokens with the scopes from the last approved/published version of the app, not the newly added scopes.
The problem:

  • Local Test has the new scope but can’t be used with external users
  • Beta Test can be used with external users but doesn’t have the new scope

This means there is no way for us to test new scopes with external Zoom accounts before submitting for re-review. Is this the expected behavior (or am I missing something)? If so, what is the recommended way to test new scope functionality end-to-end with external accounts during development?

Details:

  • App type: OAuth (Meeting SDK), already published
  • New scope added: user:read:token
  • Beta Test authorization URL uses production client_id

Thank you.

2

Beta URLs only work with production credentials; they cannot work with development credentials, and that is where new scopes sit until the new scopes are approved. The Marketplace operations team has a Zoom account that authorizes the dev version of the app, so once you do your testing in your account, you submit the app, and we test and approve it for you. Once approved, the new scopes will be automatically migrated to production.

Regards, Kwaku