Getting Invalid Token when system tries to get a new access token for user

API and Webhooks
1

Hi, We have a web app where users can connect their zoom account and see their data. They can also create the zoom meeting through our platform.

We are using the Oauth process of zoom. The problem we are facing is user’s token keeps expiring if a new user connects their zoom app with our platform. The token remains valid only for the last user.

As mentioned in the docs, the access token expires after 1 hour. So in order to get a new access token, we send a post request to the following endpoint

https://zoom.us/oauth/token?grant_type=refresh_token&refresh_token=user_refresh_token

This works fine for the user who has authenticated the zoom app most recently among all user. Bust for all the other users when their token expires and the system tries to refresh their token, then we get 401 error

{
    "reason": "Invalid Token!",
    "error": "invalid_request"
}

Any help? I am facing this issue on both Development and Production Environments.

Also currently my app is not Published yet on zoom marketplace. So i do not know if it is related to that or not.

I have tried to uninstall and reinstall the zoom app as well but no luck.

Any help will be much appreciated.

Thanks!

2

Also right now my app is not published yet. So i can only authorize the developer’s zoom account. So all of my test users are basically authorizing the same(developer’s) zoom account. Maybe that is causing the issue?

3

Hi @Sheharyar,

Is this an account level or user level app?

Once you’ve retrieved an access_token and refresh it with the refresh_token that you originally received from our /oauth endpoint, make sure that you’re using the new access_token that is returned in your refresh request. You will need to update both your access_token and refresh_token pairs each time you refresh a token.

Thanks,
Will

4

Hi @will.zoom

This is an Account level app. Yes, i am saving both Access Token and Refresh token whenever I refresh my token.
I was wondering maybe it is due to following

my app is not published yet. So i can only authorize the developer’s zoom account. So all of my test users are basically authorizing the same(developer’s) zoom account

5

Hey @Sheharyar,

As you mentioned, the issue here is that you are sharing your developer user across multiple individuals. For each Zoom user, you can only have one “live” token that’s valid. When you request a new token, the old one becomes invalid.

This is because OAuth is meant to be authorized individually. In other words, each person would have their own Zoom User under your account. They would use that Zoom User to install your app and test from there.

Then, token requests for each user won’t conflict. You can learn more in our OAuth App documentation.

I hope that helps! :slightly_smiling_face:

Thanks,
Max

6

Hi @MaxM

Thanks! That helped and cleared my thoughts,

7

Hey @Sheharyar,

Great! I’m glad to hear that was helpful. I’ll go ahead and close this topic now but feel free to open a new topic if you encounter any further issues or questions.

Thanks,
Max