# "code":124,"message":"Invalid access token."

**URL:** <https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338>\
**Category:** Meeting SDK\
**Created:** [November 14, 2023, 9:54am UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338 "2023-11-14T09:54:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![touch.ag](https://avatars.discourse-cdn.com/v4/letter/t/9dc877/32.png) [@touch.ag](https://devforum.zoom.us/u/touch.ag)\
**Post date:** [November 14, 2023, 9:54am UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/1 "2023-11-14T09:54:49Z")

</div>

Hi team,

I’m facing the error **“Invalid access token”** (code error 124) while trying to create a new meeting via the API.  
I remove app and restart again but the same code error  
The scopes I have are : meeting:write meeting:read user\_zak:read  
Please tell me why I am getting this error and how to remove it?

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [November 15, 2023, 4:00am UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/2 "2023-11-15T04:00:30Z")

</div>

@touch.ag how are you generating your access token?

---

<div class="post-metadata">

**Author:** ![touch.ag](https://avatars.discourse-cdn.com/v4/letter/t/9dc877/32.png) [@touch.ag](https://devforum.zoom.us/u/touch.ag)\
**Post date:** [November 19, 2023, 10:04pm UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/3 "2023-11-19T22:04:22Z")

</div>

Hi Chun Siong for your reply:  
i generate my access token like this :

$private function getAccessToken($code){  
$CLIENT\_ID = “xxxxxxxxx”;  
$CLIENT\_SECRET = “xxxxxxxxxxxxxxxx”;  
$REDIRECT\_URI = ‘xxxxxxxxxxxxxxxxxxxxxxxx’;

```
$token_url = 'https://zoom.us/oauth/token';

$token_data = array(
    'grant_type' => 'authorization_code',
    'code' => $code,
    'redirect_uri' => $REDIRECT_URI
);

$token_headers = array(
    'Authorization: Basic ' . base64_encode("$CLIENT_ID:$CLIENT_SECRET")
);

$ch = curl_init($token_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($token_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, $token_headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$token_response = curl_exec($ch);
$token_data = json_decode($token_response, true);

if ($token_data && isset($token_data['access_token'])) {
    return $token_data['access_token'];
} else {
    return false;
}

```

}

thank

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [November 20, 2023, 5:50am UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/4 "2023-11-20T05:50:53Z")

</div>

@touch.ag I’ll PM you for this

---

<div class="post-metadata">

**Author:** ![martin.ley](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/martin.ley/32/35741_2.png) [@martin.ley](https://devforum.zoom.us/u/martin.ley)\
**Post date:** [January 19, 2024, 12:15pm UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/5 "2024-01-19T12:15:09Z")

</div>

We’re just migrating to the new Zoom library, which requires using the JWT instead of app-id and app-secret.  
I’m getting the same error message: errorCode = 4, internalErrorCode=124.

This is the code how the JWT is generated using Scala with BouncyCastle.

```auto
  override def createJwt(issuedAt: Instant, role: Int, meetingNumber: Long): String = {

    val expiresAt = issuedAt.plus(3, HOURS)
    val header = """{"typ":"JWT","alg":"HS256"}"""
    val payload = s"""{"appKey":"$clientId","sdkKey":"$clientId","mn":$meetingNumber,"role":$role,"iat":${issuedAt.getEpochSecond},"exp":${expiresAt.getEpochSecond},"tokenExp":${expiresAt.getEpochSecond}}"""

    val encodedHeaderAndPayload = java.util.Base64.getUrlEncoder.withoutPadding().encodeToString(header.getBytes) + "." + java.util.Base64.getUrlEncoder.withoutPadding().encodeToString(payload.getBytes)

    val hmac = new HMac(new SHA256Digest())
    hmac.init(new KeyParameter(clientSecret.getBytes("UTF-8")))
    val result = new Array[Byte](hmac.getMacSize)
    val bytes = encodedHeaderAndPayload.getBytes("UTF-8")
    hmac.update(bytes, 0, bytes.length)
    hmac.doFinal(result, 0);

    return encodedHeaderAndPayload + "." + java.util.Base64.getUrlEncoder.withoutPadding().encodeToString(result)
}

```

Checking the JWT on [jwt.io](http://jwt.io) with the client-secret yields in a valid signature. Here is an example JWT signed with the client-secret `the-very-long-and-secure-client-secret`:

```auto
Header:
{
  "typ": "JWT",
  "alg": "HS256"
}
Payload:
{
  "appKey": "the-client-id",
  "sdkKey": "the-client-id",
  "mn": 123456,
  "role": 0,
  "iat": 1705665600,
  "exp": 1705676400,
  "tokenExp": 1705676400
}

JWT:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBLZXkiOiJ0aGUtY2xpZW50LWlkIiwic2RrS2V5IjoidGhlLWNsaWVudC1pZCIsIm1uIjoxMjM0NTYsInJvbGUiOjAsImlhdCI6MTcwNTY2NTYwMCwiZXhwIjoxNzA1Njc2NDAwLCJ0b2tlbkV4cCI6MTcwNTY3NjQwMH0.RgKwpgwuySzJk2k0R-_sY_vK1zNJhmK-jksD5sciwnc

```

Are the datatypes for role and mn correct? They are not stated explicitly in the documentation, so I inferred them as numbers, not strings.

Any help is appreciated. @chunsiong.zoom

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [January 23, 2024, 8:29am UTC](https://devforum.zoom.us/t/code-124-message-invalid-access-token/98338/6 "2024-01-23T08:29:32Z")

</div>

@martin.ley I’ll PM you for this