# Getting invalid token signature

**URL:** <https://devforum.zoom.us/t/getting-invalid-token-signature/34934>\
**Category:** API and Webhooks\
**Created:** [November 2, 2020, 7:14pm UTC](https://devforum.zoom.us/t/getting-invalid-token-signature/34934 "2020-11-02T19:14:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![orbot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/orbot/32/17259_2.png) [@orbot](https://devforum.zoom.us/u/orbot)\
**Post date:** [November 2, 2020, 7:14pm UTC](https://devforum.zoom.us/t/getting-invalid-token-signature/34934/1 "2020-11-02T19:14:26Z")

</div>

**Description**  
I created an app and copied the JWT token which is valid for 1 day by going into app credentials section and made a call to create a meeting and successfully got a response. However, when I generate credentials within code using JWT example given [here](https://github.com/zoom/zoom-api-jwt) I get an error. Code example -

```
async function getToken(){
	const APIKey = "API key here";
	const secret = "secret here";
	 const payload = {
	    iss: APIKey,
	    exp: ((new Date()).getTime() + 5000)
	};
	const token = jwt.sign(payload, APISecret);
	return jwt.sign(payload, secret);	
}

async function createMeeting(token){
	email = "user email here";

	let config = {
	    headers: { Authorization: `Bearer ${token}` }
	};
	let data = {
		  "topic": "test create meeting",
		  "type": 1,
		  "settings": {
		    "host_video": "true",
		    "participant_video": "true"
		  }
	};

	let resp = await axios.post( 
	  "https://api.zoom.us/v2/users/" + email + "/meetings",
	  data,
	  config
	);
	console.log(resp.data);

	return "done";
}

async function f(){
	let token = await getToken();
	console.log("token -> ", token);
	await createMeeting(token);
}

f();

```

**Error**  
{“code”:124,“message”:“The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256”}

**Which App Type (OAuth / Chatbot / JWT / Webhook)?**  
JWT

**Which Endpoint/s?**  
Problem exists with all endpoints.

**How To Reproduce (If applicable)**  
Steps to reproduce the behavior:

1. run the code given above

**Screenshots (If applicable)**  
Steps explain everything I am doing

**Additional context**  
N/A

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [November 2, 2020, 7:15pm UTC](https://devforum.zoom.us/t/getting-invalid-token-signature/34934/2 "2020-11-02T19:15:17Z")

</div>

Hey @orbot

Thanks for posting on the Zoom Devforum! I am still learning, but I will try my best to help answer your question. 🙂

Checkout these related threads that may have the answer you are looking for:

> [@Code for JWT token are giving The Token's Signature resulted invalid when verified using the Algorithm: HmacSHA256](https://devforum.zoom.us/t/-/6129):
>
> Hi @Tommy i was trying to get JWT token using Java code but it is giving “The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256” whereas after decode marketplace token and my token i am getting same key in both. Is there any API’s to get JWT token, or is there any another encoding techniques. Thanks Prem

> [@Token signature invalid](https://devforum.zoom.us/t/-/1587):
>
> Hi, Trying to hit [https://api.zoom.us/v2/users](https://api.zoom.us/v2/users) using an API key and secret that are currently working with v1 API calls and I’m getting the&nbsp;{“code”:124,“message”:“The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256”}&nbsp; result. &nbsp; I’m using the perl API from [jwt.io](http://jwt.io) and I’ve confirmed that the expire date is in the future and that the token being generated is the same as what the debugger at [jwt.io](http://jwt.io) says it should be. &nbsp; Do I need to obtain a new key a secret to w…

If these threads did not help, please let us know by replying back here and someone from the Developer Relations team will get back to you shortly.

Thanks,  
DeveloperBot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [December 3, 2020, 5:15am UTC](https://devforum.zoom.us/t/getting-invalid-token-signature/34934/3 "2020-12-03T05:15:20Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.