General App Development BYOK client assertion returns invalid_client before code validation

API and Webhooks
1

API Endpoint

POST https://zoom.us/oauth/token

Description

We are validating BYOK client authentication for an Admin-managed General App using Development credentials and OAuth Authorization Code with PKCE S256.

The authorization flow reaches the callback successfully, but the token exchange is rejected before authorization-code or PKCE validation.

Error

HTTP 400:

{"error":"invalid_client","reason":"Invalid client_id or client_secret"}

Authentication and request details verified

  • App credential mode is Public Key (BYOK), not Client Secret.
  • The request uses application/x-www-form-urlencoded.
  • No Authorization header, Basic authentication, or client_secret is sent.
  • The body contains grant_type, code, redirect_uri, code_verifier, client_id, client_assertion_type, and client_assertion.
  • The assertion header uses alg=RS256 and a kid matching the registered Development JWK.
  • iss and sub exactly match the Development Client ID.
  • aud is exactly https://zoom.us/oauth/token.
  • iat and exp are integers, the lifetime is 60 seconds, and jti is unique for every assertion.

How to reproduce

  1. Configure an Admin-managed General App’s Development credentials to use Public Key.
  2. Register a valid public JWK with a matching kid.
  3. Complete a fresh OAuth authorization and receive a new authorization code.
  4. Exchange the code at the token endpoint using the form fields listed above and a newly signed client assertion.
  5. Observe HTTP 400 invalid_client.

Additional isolation completed

  • A client-auth-only probe using a fresh assertion and a dummy code returns the same invalid_client, indicating rejection before code or PKCE validation.
  • Removing the existing Development app grant and completing a fresh consent flow did not change the result.
  • Inline RSA, temporary RSA, EC P-256, and a temporary JWKS URL registration all returned the same error.
  • After testing, the active Development configuration was restored to the original inline RSA public JWK.
  • Zoom Technical Support classified this as developer configuration and directed us to this forum.

Could someone clarify:

  1. Is BYOK client authentication supported for General App Development credentials?
  2. Does BYOK require separate account or ISV enablement in addition to selecting Public Key in App Credentials?
  3. Is https://zoom.us/oauth/token the exact expected aud value?
  4. Is any request element required beyond the documented client_id and client_assertion fields?
  5. Is there a provisioning step or propagation delay before the registered Development public key becomes available to the token endpoint?

We have intentionally not added Basic authentication, changed the documented audience, or fallen back to a client secret.

Thank you.