# Cannot renew access and refresh token (invalid\_grant) **URL:** \ **Category:** Authentication\ **Tags:** oauth, api\ **Created:** [September 1, 2022, 4:16am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224 "2022-09-01T04:16:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![housing\_ring](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@housing\_ring](https://devforum.zoom.us/u/housing_ring)\ **Post date:** [September 1, 2022, 4:16am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/1 "2022-09-01T04:16:20Z")
**API Endpoint(s) and/or Zoom API Event(s)** _[https://zoom.us/oauth/authorize?response\_type=code&client\_id=CLIENT\_ID&redirect\_uri=REDIRECT\_URI](https://zoom.us/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI)_ **Description** _We keep on receiving the error message everytime our app attempts to renew the refresh token. We’ve been receiving the same issue lately. Usually when we encounter this issue, we just reauthorize the app as a workaround and the problem is solved. But we started encountering problems with reauthorizing the app as well. When we “ **Add** ” our app in **Activation** , it redirects us to a wrong landing page in our system (there is no information yet if this happens before or after redirection for OAuth) . We also use tried using the “ **Add URL** ” but the same thing happens._ **Error?** _1. Everytime our system renew our token we get this error {“reason”:“Invalid Token!”,“error”:“invalid\_grant”}_ _2. We reauthorize app but fails._ **How To Reproduce** _Steps to reproduce the behavior:_ \*1. [https://api.zoom.us//oauth/token?grant\_type=refresh\_token&refresh\_token=REFRESH\_TOKEN&client\_id=CLIENT\_ID&client\_secret=CLIENT\_SECRET](https://api.zoom.us//oauth/token?grant_type=refresh_token&refresh_token=REFRESH_TOKEN&client_id=CLIENT_ID&client_secret=CLIENT_SECRET) \* _2. OAuth_ _3. Access and refresh token not renewed in the database. Redirect to our system landing page(not correct) during/after the API request._ ---
**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\ **Post date:** [September 13, 2022, 11:01pm UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/2 "2022-09-13T23:01:10Z")
Hi @housing_ring, it seems to me you are requesting a new access token instead of using the refresh token to request the next access token. You should ideally not be required to reauthorize the app to gain the next access token. It looks like you are passing a request to the /oauth/token endpoint using the client ID and client secret as query parameters, but this should be sent as an Authorization header rather than as a query parameter. > **[OAuth with Zoom](https://developers.zoom.us/docs/guides/auth/oauth/#refreshing-an-access-token)** > > The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform. ---
**Author:** ![housing\_ring](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@housing\_ring](https://devforum.zoom.us/u/housing_ring)\ **Post date:** [September 14, 2022, 5:33am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/3 "2022-09-14T05:33:20Z")
Hello Michael, > it seems to me you are requesting a new access token instead of using the refresh token to request the next access token. Yes, you’re right. The reason we performed this method was that we cannot request a new token using our refresh token. We always get the `invalid_grant` error. > It looks like you are passing a request to the /oauth/token endpoint using the client ID and client secret as query parameters, but this should be sent as an Authorization header rather than as a query parameter. Sorry, there was a slight mix-up on this part. The link indicated on Step 1 was the link we got from the reauthorization button (“Add” button). In regards to what you said, yes, we passed the client id and client secret as an Authorization header just as what the documentation says. Any other idea what could be the reason for this? Thank you, Ring ---
**Author:** ![housing\_ring](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@housing\_ring](https://devforum.zoom.us/u/housing_ring)\ **Post date:** [September 14, 2022, 9:58am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/5 "2022-09-14T09:58:31Z")
Hello @michael.zoom , We also store our tokens in our database. And we are aware that refresh tokens last for 15 years but how come we get “Invalid\_token”, “Invalid\_grant” errors. Any idea? Regards, Ring ---
**Author:** ![housing\_ring](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@housing\_ring](https://devforum.zoom.us/u/housing_ring)\ **Post date:** [September 16, 2022, 6:11am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/6 "2022-09-16T06:11:12Z")
We had a series of tests in our system and noticed that there was an inconsistency when renewing a token. Sometimes it is successful and sometimes it also returns an “Invalid\_grant” error even thought we use the old refresh token strored in our database. Usually, error happens when token is renewed after days (let’s say after a week). Do you have any idea on what’s the cause or maybe how to prevent this in the future? If you need logs from our system for analysis, please let me know. Regards, Ring ---
**Author:** ![devind](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/devind/32/37758_2.png) [@devind](https://devforum.zoom.us/u/devind)\ **Post date:** [September 21, 2022, 7:44pm UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/7 "2022-09-21T19:44:28Z")
I am also having inconsistency issues renewing tokens (we store the new refresh and access token after every request ) and notice these 400s after a while after token has been created. ---
**Author:** ![rsamarak](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@rsamarak](https://devforum.zoom.us/u/rsamarak)\ **Post date:** [November 3, 2023, 2:34am UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/9 "2023-11-03T02:34:16Z")
I’m running into the same issue as the other posters where I’m sending a properly formatted refresh token request and sometimes it succeeds and other times it fails with http 400 invalid grant. Can someone from zoom take a look? These kinds of bugs should not exist on your production platform. BTW, I initially attempted to sign up for [devforum.zoom.us](http://devforum.zoom.us) with the same zoom account that I use for your marketplace and got the message “You cannot authorize Zoom Developer Forum Log-in HelperBETA”. I had to use a different zoom account to sign up for [devforum.zoom.us](http://devforum.zoom.us). In other words, you can’t get your own oauth working on your own website. That’s really pathetic and you guys need to get your s\*\*\* together. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 3, 2023, 12:48pm UTC](https://devforum.zoom.us/t/cannot-renew-access-and-refresh-token-invalid-grant/75224/10 "2023-11-03T12:48:29Z")
Hey @rsamarak Sorry to hear you are having issues with refresh tokens and trying to authorize the Dev Forum Log-in Oauth, I can take a closer look to this issue I will send you a private message to request more information Please follow up there