# Code: 124 Invalid Access Token in S2S OAuth

**URL:** <https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873>\
**Category:** API and Webhooks\
**Tags:** api, s2s-oauth\
**Created:** [October 16, 2023, 8:40pm UTC](https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873 "2023-10-16T20:40:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![maincareenergy](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@maincareenergy](https://devforum.zoom.us/u/maincareenergy)\
**Post date:** [October 16, 2023, 8:40pm UTC](https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873/1 "2023-10-16T20:40:38Z")

</div>

We’re a single-user Pro account looking to create automatic meetings with our business’ customers.

We were previously using JWT and we’re trying to migrate to S2S OAuth now that JWT is deprecated.

The application’s work flow went:  
Note: The forum is complaining about me posting “more than 2 links”, so I have to replace forward slashes with dollar signs so I can communicate endpoint information to you.

1. Get list of users: api.zoom.us$v2$Users
2. Since we’re single-user, get the ID of the zeroeth user.
3. Foreach unscheduledCustomer: POST api.zoom.us$v2$users${zeroethUserID}$meetings with the meeting data.
4. On success, mark the customer as scheduled.

We missed the memo about JWT being deprecated so this was working great until today.

What’s happening NOW is:

1. I’m authenticating at this endpoint:  
zoom.us$oauth$token?grant\_type=account\_credentials&account\_id={AccountID}

2. I’m receiving something like this as a response:

```auto
"access_token":"blahblahblah",
"token_type":"bearer",
"expires_in":3599,"
scope":"information_barriers:write:admin account:master user:master meeting:write:admin meeting:master information_barriers:write:master"

```

1. I’m storing the access\_token variable as a string called OAuthBearerToken

2. Replacing AccountID with the API’s account ID, I do: api.zoom.us$v2$accounts${AccountID}$users  
`Authorization: Bearer {OAuthBearerToken}`

And I’m getting a 401: Invalid access token.

I’m getting the same results in Postman. I feel like I must be missing something obvious in the documentation but I’m stumped as to what. Any assistance?

---

<div class="post-metadata">

**Author:** ![maincareenergy](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@maincareenergy](https://devforum.zoom.us/u/maincareenergy)\
**Post date:** [October 16, 2023, 9:22pm UTC](https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873/2 "2023-10-16T21:22:20Z")

</div>

Turns out I didn’t grant myself enough scope.

Despite having “user:master”, I needed “user:read:admin” as well.

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [October 17, 2023, 2:15pm UTC](https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873/3 "2023-10-17T14:15:59Z")

</div>

Glad this is resolved!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [October 18, 2023, 2:16pm UTC](https://devforum.zoom.us/t/code-124-invalid-access-token-in-s2s-oauth/96873/4 "2023-10-18T14:16:10Z")

</div>

Closed on October 18, 2023, 2:16pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.