# Getting Zoom Token returning 401 unauthorized

**URL:** <https://devforum.zoom.us/t/getting-zoom-token-returning-401-unauthorized/86173>\
**Category:** Meetings\
**Created:** [April 6, 2023, 4:05am UTC](https://devforum.zoom.us/t/getting-zoom-token-returning-401-unauthorized/86173 "2023-04-06T04:05:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![healtppy](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@healtppy](https://devforum.zoom.us/u/healtppy)\
**Post date:** [April 6, 2023, 4:05am UTC](https://devforum.zoom.us/t/getting-zoom-token-returning-401-unauthorized/86173/1 "2023-04-06T04:05:45Z")

</div>

We are now using the following api to get zoom token for starting meeting through my mobile app. I’m now using zoom meeting sdk 5.12.0 for both android and iOS.

[https://zoom.us/v2/users/healtppy@gmail.com/token?type=token&access\_token={access\_token}](https://zoom.us/v2/users/healtppy@gmail.com/token?type=token&access_token=%7Baccess_token%7D)

Now, the end point is always returning 401 unauthorized with the error message "

Invalid access token, this access token is not supported as query parameter string

" and the code in the response is 124.  
So, is the api mentioned above deprecated? If it is, let us know any alternate ways to get the zoom token since the app is currently live in their respective stores.

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [April 6, 2023, 1:25pm UTC](https://devforum.zoom.us/t/getting-zoom-token-returning-401-unauthorized/86173/2 "2023-04-06T13:25:50Z")

</div>

You’ll need to [pass sensitive parameters in the request body or request headers](https://devforum.zoom.us/t/security-update-no-token-values-in-url-query-parameters/78782) now to keep it out of log files. For the request body, make sure to use the `POST` method, and set the `Content-Type` header to align with how you’re formatting the request body.
