# In-client OAuth has stopped working

**URL:** <https://devforum.zoom.us/t/in-client-oauth-has-stopped-working/131893>\
**Category:** Zoom Apps\
**Created:** [April 24, 2025, 4:30pm UTC](https://devforum.zoom.us/t/in-client-oauth-has-stopped-working/131893 "2025-04-24T16:30:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dominic.light](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@dominic.light](https://devforum.zoom.us/u/dominic.light)\
**Post date:** [April 24, 2025, 4:30pm UTC](https://devforum.zoom.us/t/in-client-oauth-has-stopped-working/131893/1 "2025-04-24T16:30:42Z")

</div>

**Zoom Apps Configuration**  
Angular 19 app using `@zoom/appssdk@0.16.27`.

**Description**  
We are using in-client OAuth to authenticate users (`authorize` / `onAuthorized`) with a PKCE verifier using `"code_challenge_method": "S256"`, which was working perfectly in our published app until the 9th of April. After that, we started occasionally seeing `Invalid Authorization Code` / `invalid_grant` errors when calling `/oauth/token` to redeem the authorization code. As of the 11th of April, this has now stopped working entirely and always returns `invalid_grant`. We have not made any changes to our apps, so this appears to be a breaking change on Zoom’s side.

A related post here mentions that PKCE may no longer work with a `plain` `code_challenge_method`. We are using a SHA-256 hash with `"code_challenge_method": "S256"`, so this does not appear to be exactly the same issue, although the timeframe lines up with the issues we are seeing.

> [@Authorization codes generated from the zoom app are no longer valid (Invalid authorization code)](https://devforum.zoom.us/t/authorization-codes-generated-from-the-zoom-app-are-no-longer-valid-invalid-authorization-code/131546):
>
> API Endpoint(s) and/or Zoom API Event(s) /oauth/token Description Users can no longer generate access tokens in our apps. We use the zoom apps sdk (“authorize/onAuthorized” flow) to generate the authorization code, then pass the code to our server where it is used to get an access token. This was working in our published app up until very recently (at least 2 weeks ago we know for sure this was working). Have verified that nothing seems to have changed according to your docs, stuff like the…

**Error?**

` [{ “reason”: “Invalid authorization code”, “error”: “invalid_grant” }]`

**Troubleshooting Routes**  
We have tried changing to a `plain` verifier, and removing the PKCE verifier entirely, but this just gives the same error. We have 3 separate apps which are all affected in exactly the same way.

**How To Reproduce**  
Use the in-client OAuth flow with a SHA-256-hashed verifier, then attempt to redeem the authorization code with a request to `https://zoom.us/oauth/token`, as described in [Authentication](https://developers.zoom.us/docs/zoom-apps/authentication/#enabling-in-client-oauth-for-your-app), and [GitHub - zoom/zoomapps-advancedsample-react: This repository contains an Advanced Zoom Apps Sample. It should serve as a starting point for you to build and test your own Zoom App in development.](https://github.com/zoom/zoomapps-advancedsample-react/tree/main).

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [April 25, 2025, 7:37pm UTC](https://devforum.zoom.us/t/in-client-oauth-has-stopped-working/131893/2 "2025-04-25T19:37:29Z")

</div>

Hi @dominic.light  
Thanks for reaching out to us.  
I was going to share with you the response from the other developer, who confirmed that using s264 PKCEs instead of plain works for them.  
You mentioned it is not the case for you, correct?  
I will send you a DM to look further into this and report it to our Engineering team if needed