# General App Development BYOK client assertion returns invalid\_client before code validation

**URL:** <https://devforum.zoom.us/t/general-app-development-byok-client-assertion-returns-invalid-client-before-code-validation/146052>\
**Category:** API and Webhooks\
**Created:** [August 31, 2026, 4:38am UTC](https://devforum.zoom.us/t/general-app-development-byok-client-assertion-returns-invalid-client-before-code-validation/146052 "2026-08-31T04:38:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akira](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/akira/32/76344_2.png) [@Akira](https://devforum.zoom.us/u/Akira)\
**Post date:** [August 31, 2026, 4:38am UTC](https://devforum.zoom.us/t/general-app-development-byok-client-assertion-returns-invalid-client-before-code-validation/146052/1 "2026-08-31T04:38:46Z")

</div>

### **API Endpoint**

`POST https://zoom.us/oauth/token`

**Description**

We are validating BYOK client authentication for an Admin-managed General App using Development credentials and OAuth Authorization Code with PKCE S256.

The authorization flow reaches the callback successfully, but the token exchange is rejected before authorization-code or PKCE validation.

**Error**

HTTP 400:

```json
{"error":"invalid_client","reason":"Invalid client_id or client_secret"}

```

**Authentication and request details verified**

- App credential mode is Public Key (BYOK), not Client Secret.
- The request uses `application/x-www-form-urlencoded`.
- No `Authorization` header, Basic authentication, or `client_secret` is sent.
- The body contains `grant_type`, `code`, `redirect_uri`, `code_verifier`, `client_id`, `client_assertion_type`, and `client_assertion`.
- The assertion header uses `alg=RS256` and a `kid` matching the registered Development JWK.
- `iss` and `sub` exactly match the Development Client ID.
- `aud` is exactly `https://zoom.us/oauth/token`.
- `iat` and `exp` are integers, the lifetime is 60 seconds, and `jti` is unique for every assertion.

**How to reproduce**

1. Configure an Admin-managed General App’s Development credentials to use Public Key.
2. Register a valid public JWK with a matching `kid`.
3. Complete a fresh OAuth authorization and receive a new authorization code.
4. Exchange the code at the token endpoint using the form fields listed above and a newly signed client assertion.
5. Observe HTTP 400 `invalid_client`.

**Additional isolation completed**

- A client-auth-only probe using a fresh assertion and a dummy code returns the same `invalid_client`, indicating rejection before code or PKCE validation.
- Removing the existing Development app grant and completing a fresh consent flow did not change the result.
- Inline RSA, temporary RSA, EC P-256, and a temporary JWKS URL registration all returned the same error.
- After testing, the active Development configuration was restored to the original inline RSA public JWK.
- Zoom Technical Support classified this as developer configuration and directed us to this forum.

Could someone clarify:

1. Is BYOK client authentication supported for General App Development credentials?
2. Does BYOK require separate account or ISV enablement in addition to selecting Public Key in App Credentials?
3. Is `https://zoom.us/oauth/token` the exact expected `aud` value?
4. Is any request element required beyond the documented `client_id` and `client_assertion` fields?
5. Is there a provisioning step or propagation delay before the registered Development public key becomes available to the token endpoint?

We have intentionally not added Basic authentication, changed the documented audience, or fallen back to a client secret.

Thank you.