# Getting {'code': 124, 'message': 'Invalid access token.'} when calling /chat/users/{userId}/messages/files. How to fix the problem? **URL:** \ **Category:** Chat\ **Created:** [November 8, 2022, 11:03am UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461 "2022-11-08T11:03:44Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Staysmoon](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/staysmoon/32/36611_2.png) [@Staysmoon](https://devforum.zoom.us/u/Staysmoon)\ **Post date:** [November 8, 2022, 11:03am UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/1 "2022-11-08T11:03:44Z")
**Description** Just this week I started getting the error {‘code’: 124, ‘message’: ‘Invalid access token.’} when calling /chat/users/{userId}/messages/files endpoing with an oauth access token. I am using this endpoint to upload a newly generated file on a callback call to my backend. I event tried revoking the token and using your sample application (zoomapps-sample-js) to generate access tokens to call the ‘files’ endpoint. Nothing seems to work. **Error** {‘code’: 124, ‘message’: ‘Invalid access token.’} when calling both /chat/users/{userId}/messages/files and /chat/users/me/messages/files with a seemingly valid access token via Postman. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 21, 2022, 2:26pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/2 "2022-11-21T14:26:28Z")
Hi @Staysmoon Thanks for reaching out to the Zoom Developer Forum and welcome to our community! Are you still experiencing this issue or were you able to solve it? Please, let me know if there is anything I can do to support you Best, Elisa ---
**Author:** ![Staysmoon](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/staysmoon/32/36611_2.png) [@Staysmoon](https://devforum.zoom.us/u/Staysmoon)\ **Post date:** [November 21, 2022, 3:01pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/3 "2022-11-21T15:01:21Z")
Hi @elisa.zoom! Unfortunately, I am still experiencing the problem. Double checked it yesterday and still no result. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 21, 2022, 3:58pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/4 "2022-11-21T15:58:10Z")
Thanks @Staysmoon Could you please share with me how are you generating the access token that you are trying to use to call our Chat endpoints? Also, what kind of application are you using to generate those access tokens? Best, Elisa ---
**Author:** ![Staysmoon](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/staysmoon/32/36611_2.png) [@Staysmoon](https://devforum.zoom.us/u/Staysmoon)\ **Post date:** [November 21, 2022, 6:06pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/5 "2022-11-21T18:06:55Z")
I am generating the token according to zoom’s guidelines ([OAuth with Zoom](https://marketplace.zoom.us/docs/guides/auth/oauth/)) with the ‘chat\_message:write’ scope. As for the app itself, I am building a document management app (office editor) so this endpoint is cruicial to make it working. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 21, 2022, 6:27pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/6 "2022-11-21T18:27:47Z")
Could you please share the complete request URL that you are sending when requesting the access\_token please @Staysmoon ---
**Author:** ![Staysmoon](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/staysmoon/32/36611_2.png) [@Staysmoon](https://devforum.zoom.us/u/Staysmoon)\ **Post date:** [November 22, 2022, 7:56am UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/7 "2022-11-22T07:56:07Z")
The URL is [https://zoom.us/oauth/token?code={code}&code\_verifier={verifier}&redirect\_uri={auth\_redirect\_uri}&grant\_type=authorization\_code](https://zoom.us/oauth/token?code=%7Bcode%7D&code_verifier=%7Bverifier%7D&redirect_uri=%7Bauth_redirect_uri%7D&grant_type=authorization_code) (‘code’ and ‘verifier’ from redirect\_uri when users authorize my app) @elisa.zoom ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 28, 2022, 10:31pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/8 "2022-11-28T22:31:26Z")
Hi @Staysmoon Sorry for the late reply. If you have not been able to fix this issue, I would recommend you look into this amazing guide written by one of my colleagues that is relevant to the issue you are facing: > [@Zoom OAuth 2.0 Proof Key for Code Exchange (PKCE) Flow](https://devforum.zoom.us/t/zoom-oauth-2-0-proof-key-for-code-exchange-pkce-flow/63830): > > Summary Zoom supports Proof of Key Code Exchange (PKCE), pronounced “Pixy”, industry - standard protocol for authorization when requesting user tokens. This offers better security by enabling clients to use a code challenge and code exchange as part of the initial user authorization request. See [rfc7636](https://tools.ietf.org/html/rfc7636) for details. What is PKCE? PKCE is an extension to the OAuth 2 spec. Its design aims to add an additional layer of security that verifies that the authentication and token exchange requests co… ---
**Author:** ![tech5](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tech5/32/46509_2.png) [@tech5](https://devforum.zoom.us/u/tech5)\ **Post date:** [March 16, 2023, 3:03pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/9 "2023-03-16T15:03:48Z")
Hi Elisa, I have the same issue. I am using this endpoint to get the token (and it is working fine) `[https://zoom.us/oauth/token?grant\_type=account\_credentials&account\_id=xxxxxx](https://zoom.us/oauth/token?grant_type=account_credentials&account_id=xxxxxx) After retrieving the token, I am trying (using Rester) to call an endpoint, for example (same response for all the endpoints I tried), **[https://api.zoom.us/v2/users,](https://api.zoom.us/v2/users,)** but I always get the same response: ```auto { "code": 124, "message": "Invalid access token." } ``` ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [March 16, 2023, 6:07pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/10 "2023-03-16T18:07:25Z")
Hi @tech5 Thanks for reaching out and welcome to our community. Can you please verify that your server to server app has the right scopes added to call the endpoints you need? ---
**Author:** ![tech5](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tech5/32/46509_2.png) [@tech5](https://devforum.zoom.us/u/tech5)\ **Post date:** [March 17, 2023, 2:45am UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/13 "2023-03-17T02:45:31Z")
Hi, I posted an extensive (and detailed) reply for you, but it seems that your system removed it (two times ), now I have to start from the beginning. All the endpoints return the same error. I added the right permission, but as I commented all the endpoints (I tried many), return the same 124 code. On the other hand, I tried to import the file I downloaded from here (spec) [https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#overview](https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#overview) but the importation process to POSTMAN returns an error (I am trying to share screenshots with you here, but it seems that is not possible). We have many customers using the JWT app, and we need to migrate to the " server to server app " but at the moment I did not find any clear documentation for this thing, it looks a bit confusing and there are not examples for PHP Etc… Updated: This is how I call this endpoint, and how I pass the token I get from /oauth/token endpoint [![](https://pasteboard.co/ZgARLOb1wtlj.png) ](https://pasteboard.co/ZgARLOb1wtlj.png) I use Rester for testing the API (and postman as well). This is how I pass the token. **Authorization: Bearer lVDFKdmFDZzp0SXdmUFBycDg3ekJNQ2hhMFdCejQ0cUI4OG1OA==** Note: Finally I saw many posts and I removed all of them leaving only this one. Trying to attach images to this post I got this message many times “An error occurred: Sorry, you can’t embed media items in a post.” If I am not allowed to attach images, why does the editor show this option? How I can explain the problem if I cannot upload a single screenshot :). **Update** : I am using Rester App to test the endpoints, and after moving “Bearer” from the environment constant “Token”, it works, but now I get a new error “ **Invalid CORS reques** t”, is it not possible to test the endpoint using Rester or Postman? Should I call the endpoints from the server in order to test them? I am trying the endpoint [https://api.zoom.us/v2/users](https://api.zoom.us/v2/users) to get the users list. Regards Kind regards. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [March 17, 2023, 2:58pm UTC](https://devforum.zoom.us/t/getting-code-124-message-invalid-access-token-when-calling-chat-users-userid-messages-files-how-to-fix-the-problem/78461/14 "2023-03-17T14:58:06Z")
Hi @tech5 Thanks for sharing more details with us and sorry that your post got deleted and that you are having trouble downloading the API spec We have a Postman public space that you can use to test, please refer to the following post: > [@Zoom API Testing Made Easy with Postman Public Workspace](https://devforum.zoom.us/t/zoom-api-testing-made-easy-with-postman-public-workspace/75062): > > Article originally posted on [dev.to](https://dev.to/zoom/zoom-api-testing-made-easy-with-postman-public-workspace-5fh7) If you’re a developer or technical decision maker using Zoom APIs to: hammer_and_wrench build a customized video communications experience or, speaking_head tell impactful business intelligence stories, …it’s now easier than ever to test those APIs in a curated way! We’ve created a [Postman public workspace](https://www.postman.com/zoom-developer/workspace/zoom-public-workspace/overview) with done-for-you workflows to get access to and make streamlined requests to Zoom API endpoints. [Image description] How to Use Zoom’s Public … I also want to share this post about how to user the Server to server oauth app with postman: > [@How to user Server-to-Sever OAuth app with Postman](https://devforum.zoom.us/t/how-to-user-server-to-sever-oauth-app-with-postman/70848): > > How to use our Server-to-Server OAuth with Postman? As some of you might be aware of, our JWT app is being deprecated by June 2023 and we encourage you to migrate to the newly introduced [Server-to-Server OAuth App](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app) That being said, here is a quick and simple guide on how to use or new app with Postman As stated in our documentation here: This new app type facilitates OAuth-authenticated requests between servers without end-user involvement. And this grant type enable your private server a… I hope some of this information help