# In-client auth - Invalid authorization code

**URL:** <https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062>\
**Category:** Zoom Apps\
**Created:** [October 6, 2022, 9:35pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062 "2022-10-06T21:35:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![brad.bicknell](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brad.bicknell/32/42028_2.png) [@brad.bicknell](https://devforum.zoom.us/u/brad.bicknell)\
**Post date:** [October 6, 2022, 9:35pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062/1 "2022-10-06T21:35:03Z")

</div>

**Zoom Apps Configuration**  
React with Backend Service  
ZoomSdk version 16.5 installed via npm [GitHub - zoom/appssdk: Build Apps that run in the Zoom Client](https://github.com/zoom/appssdk)

**Description**  
I am working on implementing in-client auth and am able to successfully receive a response and code from the zoomSdk.authorize and zoomSdk.addEventListener(“onAuthorized”, callback) methods. However, when using the code from the onAuthorized callback to request an access token, I’m receiving an error from the Zoom token endpoint.

**Error?**  
When attempting to fetch a token I get the following response:

`{'reason': 'Invalid authorization code jH8sFKaViM_RSTLNTS-Tk-_mCVkEdZpAQ', 'error': 'invalid_grant’}`

The code above is the one received in the onAuthorize callback.

**Troubleshooting Routes**  
I’ve already attempted generating the PKCE challenge and verifier manually to rule out issues with the code\_verifier being sent to Zoom’s /oauth/token url

**How To Reproduce**  
I’m using a development app to test in-client auth and am following the work-around described in zoom docs to test.

In the FE - authorize and handle onAuthorized callback

```auto
zoomSdk.authorize({ codeChallenge })
zoomSdk.sendEventListener("onAuthorized", getTokenViaBackend)

```

In the BE - Get the code and code\_verifier from the FE request and make a call to the zoom token endpoint, which results in the error message above.

```auto
params = {
  grant_type: "authorization_code",
  redirect_uri: redirect_uri,
  "code": code,
  "code_verifier": code_verifier
}

requests.post(url=https://zoom.us/oauth/token?{urlencode(search_params}, 
auth=basic_auth(client_id:client_secret),
headers={"Content-Type": "application/x-www-form-urlencoded"}),

```

Any help would be appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![brad.bicknell](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brad.bicknell/32/42028_2.png) [@brad.bicknell](https://devforum.zoom.us/u/brad.bicknell)\
**Post date:** [October 6, 2022, 10:02pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062/2 "2022-10-06T22:02:52Z")

</div>

Welp. It appears like something is amiss with the developer docs.

The docs say that SHA256 is the only challenge method that’s supported. However, when I generated using PLAIN (no sha256 encoding, the challenge and the verifier are the same string), I was able to successfully complete the auth flow and get an auth token.

The question I have now is, is it okay/preferred to leave my app using the plain pkce method? Or does something need to be updated on Zoom’s side?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [October 20, 2022, 7:42pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062/3 "2022-10-20T19:42:09Z")

</div>

@brad.bicknell My apologies for the delay getting back to you. You should indeed be able to use SHA256 encoding for your challenge method.

Are you seeing this same behavior outside of the client or only when using in-client authorization? With in-client authorization, you should be using the authorize() function which doesn’t have a challenge method parameter. More information [here](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication/).

I’ll note that the authorization code does expire after 10 minute which can produce this error as well.

---

<div class="post-metadata">

**Author:** ![brad.bicknell](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brad.bicknell/32/42028_2.png) [@brad.bicknell](https://devforum.zoom.us/u/brad.bicknell)\
**Post date:** [October 26, 2022, 10:30pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062/5 "2022-10-26T22:30:17Z")

</div>

Hi @MaxM,

We are only using the PCKE method in in-client authorization. I’m not sure what you mean when you say that the `authorize()` function doesn’t have a challenge method parameter. The api docs have it listed as a required parameter [Zoom Apps JS SDK reference](https://marketplace.zoom.us/docs/zoom-apps/js-sdk/reference/#authorize) `codeChallenge` as well as the example you linked to:

 ![Screen Shot 2022-10-26 at 3.28.40 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/2/8/28ba9cc92f2c4730aba88e47b4c6a22745ab846f.jpeg)

Please let me know what additional information I can provide. For now, I’m unblocked using the “plain” method to generate a challenge and verifier, but it seems like I _should_ be able to use the SHA256 method to get an encrypted verifier.

Thanks!

---

<div class="post-metadata">

**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\
**Post date:** [October 26, 2022, 11:27pm UTC](https://devforum.zoom.us/t/in-client-auth-invalid-authorization-code/77062/6 "2022-10-26T23:27:01Z")

</div>

See here: [Unable to exchange token during in-client oauth flow (and other issues) - #10 by ash.provost](https://devforum.zoom.us/t/unable-to-exchange-token-during-in-client-oauth-flow-and-other-issues/77933/10)