# Error 403 (forbidden) when trying to get oauth access token

**URL:** <https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745>\
**Category:** API and Webhooks\
**Created:** [January 5, 2021, 5:34pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745 "2021-01-05T17:34:29Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![JonaDuran](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonaduran/32/20978_2.png) [@JonaDuran](https://devforum.zoom.us/u/JonaDuran)\
**Post date:** [January 5, 2021, 5:34pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/1 "2021-01-05T17:34:29Z")

</div>

Hi, I have been trying to get oauth access token from a server with PHP but I always get 403 error.  
I saw other similar post but they seem to have been resolved by private message or using `Content-Type: application/json`.

This is my test code:

```
$url = 'https://zoom.us/oauth/token?grant_type=authorization_code&code=u6NUmBQkQV_KQicgZepTombV7amtbobPQ';
$auth = base64_encode($this->zoom_client_id . ':' . $this->zoom_client_secret);
$context = stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' => "Authorization: Basic $auth\r\nContent-Type: application/json\r\n",
    ]
]);
echo file_get_contents($url, false, $context);
```

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [January 5, 2021, 10:49pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/2 "2021-01-05T22:49:02Z")

</div>

Hey @JonaDuran,

Thank you for reaching out to the Zoom Developer Forum. Are you able to make this request successfully when using a REST client to handle the OAuth flow, such as Postman? I would also make sure that you are including a `redirect_uri` as listed in the [OAuth documentation](https://marketplace.zoom.us/docs/guides/auth/oauth#step-2-request-access-token).

While this may not be exactly related, you may also want to pass headers as an array instead of a string:

> **[Setting Multiple Headers in a PHP Stream Context](https://lornajane.net/posts/2013/setting-multiple-headers-in-a-php-stream-context)**
>
> Last week I tried to create a PHP stream context which set multiple headers; an Authorization header and a Content-Type header. All the examples I could find showed headers built up as a string wit…

Let me know if that helps.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![JonaDuran](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonaduran/32/20978_2.png) [@JonaDuran](https://devforum.zoom.us/u/JonaDuran)\
**Post date:** [January 6, 2021, 8:35pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/3 "2021-01-06T20:35:03Z")

</div>

Hi @MaxM, I get the same error passing `redirect_uri`, now I can see that the reason is “Redirect URI mismatch” but the answer is the same with any` redirect_uri` even if it is on my whitelist or in the “Redirect URL for OAuth” field.

 ![Screen Shot 2021-01-06 at 2.26.04 p.m.](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/5/b5e4d089369791f7b3c12ad35c9bf7ddd84e75ae.png)

 ![Screen Shot 2021-01-06 at 2.29.05 p.m.](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/8/6/8696f5345ac3aef99f70619983cad56fa51be7b3.png)

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [January 7, 2021, 7:23pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/4 "2021-01-07T19:23:38Z")

</div>

Hey @JonaDuran,

Thank you for testing that, do you get the same error if you add the entire OAuth redirect URL to your whitelist?

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![JonaDuran](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonaduran/32/20978_2.png) [@JonaDuran](https://devforum.zoom.us/u/JonaDuran)\
**Post date:** [January 7, 2021, 8:01pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/5 "2021-01-07T20:01:46Z")

</div>

Yes @MaxM, I get exactly the same error.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [January 8, 2021, 9:05pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/6 "2021-01-08T21:05:19Z")

</div>

Hey @JonaDuran,

Thank you for the update. When you’re testing this locally, are you using a port other than `80` or `443`? If so, please try adding the port that you’re using to the whitelist.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![JonaDuran](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonaduran/32/20978_2.png) [@JonaDuran](https://devforum.zoom.us/u/JonaDuran)\
**Post date:** [January 8, 2021, 10:30pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/7 "2021-01-08T22:30:57Z")

</div>

@MaxM, I’m using the port 80, I did the test that you comment and the answer is the same.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [January 11, 2021, 8:37pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/8 "2021-01-11T20:37:56Z")

</div>

Hey @JonaDuran,

I did a bit more digging into this and it looks like this is a known issue for URLs that are not publicly accessible. Please see the following forum post for more information on this:

> [@Zoom Application Wrong redirect](https://devforum.zoom.us/t/zoom-application-wrong-redirect/4402/4):
>
> Hey Subhan, I was able to reproduce this issue, and we are working on a solution now. I will post back when we have a solution. Thanks for your patience!

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![JonaDuran](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonaduran/32/20978_2.png) [@JonaDuran](https://devforum.zoom.us/u/JonaDuran)\
**Post date:** [January 14, 2021, 5:09pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/9 "2021-01-14T17:09:35Z")

</div>

Hi @MaxM, I get the same answer.

 ![Screen Shot 2021-01-14 at 11.04.23 a.m.](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/5/8/5851bf40d760afed6f6f4e8a76933cb65911ecf9.png)

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [January 15, 2021, 8:20pm UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/10 "2021-01-15T20:20:38Z")

</div>

Hey @JonaDuran,

It looks like you’re doing everything right, the only advice I have to offer is to make sure that you’re updating the whitelist/redirect URL each time you restart your ngrok server as it does change on each server restart. If that doesn’t help, I’ve DM’d you a tool to schedule a meeting so we can investigate this over Zoom.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [February 15, 2021, 6:20am UTC](https://devforum.zoom.us/t/error-403-forbidden-when-trying-to-get-oauth-access-token/39745/11 "2021-02-15T06:20:42Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.