# In-client OAuth not accepting post requests

**URL:** <https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482>\
**Category:** Zoom Apps\
**Created:** [June 30, 2022, 5:57pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482 "2022-06-30T17:57:23Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [June 30, 2022, 5:57pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/1 "2022-06-30T17:57:23Z")

</div>

Attempting to follow the In-client Oauth flow, and finding I am unable to make a POST request to the auth/token endpoint.

Specifically, when onAuthorized is called, I initiate the following POST request as per the documentation:

```auto
zoomSdk.onAuthorized(async (event) => {
      console.log("onAuthorized: ",event);
      $.post('https://zoom.us/api/v1/auth/token',
        event,
        function (data, status){
          console.log("Data",data);
          console.log("status",status);
        }
      )
    });

```

In the console, this results in:

```auto
[Error] Origin https://468b-64-7-75-105.ngrok.io is not allowed by Access-Control-Allow-Origin.
[Error] XMLHttpRequest cannot load https://zoom.us/api/v1/auth/token due to access control checks.
[Error] Failed to load resource: Origin https://468b-64-7-75-105.ngrok.io is not allowed by Access-Control-Allow-Origin. (token, line 0)

```

In-client OAuth has been turned on for the app, the [ngrok.io](http://ngrok.io) domain has been added to the Apps “OAuth allow list,” and the [zoom.us](http://zoom.us) domain has been added to the “Domain allow list.”

What am I missing?

---

<div class="post-metadata">

**Author:** ![ash.provost](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ash.provost/32/36610_2.png) [@ash.provost](https://devforum.zoom.us/u/ash.provost)\
**Post date:** [June 30, 2022, 10:26pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/2 "2022-06-30T22:26:17Z")

</div>

> [@vandalayindustries](#):
>
> `not allowed by Access-Control-Allow-Origin`

Have you properly set your OWASP headers in the app?

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 1, 2022, 2:58am UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/3 "2022-07-01T02:58:13Z")

</div>

Hi @ash.provost, thanks for the quick response.

The headers set on our server don’t seem to make any difference (eg tried setting `"Access-Control-Allow-Origin: *"`).

As far as I understand, the issue is that the headers on the Zoom API endpoint `https://zoom.us/api/v1/auth/token` are not allowing requests from the ngrok domain, despite it being added to the OAuth and Domain allow lists within the app.

Can you confirm the API url is correct? Are there any headers it is expecting that aren’t in the documentation? Anything else I could be missing?

---

<div class="post-metadata">

**Author:** ![andy1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/andy1/32/34382_2.png) [@andy1](https://devforum.zoom.us/u/andy1)\
**Post date:** [July 1, 2022, 3:19pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/4 "2022-07-01T15:19:34Z")

</div>

Hi @vandalayindustries I think Ash means this …  
[Zoom Developer Docs - OWASP](https://marketplace.zoom.us/docs/zoom-apps/publishing-an-app/owasp/)

I haven’t tried what you are doing yet but I need to here in the near future. I’ve been looking at the advanced sample and trying to match what it does. It does have these headers.  
[zoom/zoomapps-advancedsample-react: (github.com)](https://github.com/zoom/zoomapps-advancedsample-react)

(I’m also seeing CORS issues when I call an api locally from my app … it works ok if I publish my app somewhere though. I’m looking at verifying these headers.)  
–Andy

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 1, 2022, 6:48pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/5 "2022-07-01T18:48:11Z")

</div>

Hey @andy1 thanks for the pointer.

I tried using the OWASP headers set in the advancedsample app you pointed out. Specifically those found [here](https://github.com/zoom/zoomapps-advancedsample-react/blob/main/backend/middleware.js):

```auto
    res.setHeader('Strict-Transport-Security', 'max-age=31536000')
    res.setHeader('X-Content-Type-Options', 'nosniff')
    // This CSP is an example, it might not work for your webpage(s)
    // You can generate correct CSP for your webpage here https://www.cspisawesome.com/
    const publicUrl = process.env.PUBLIC_URL
    const { host } = new URL(publicUrl)
    res.setHeader(
      'Content-Security-Policy',
      `default-src *; style-src 'self' 'unsafe-inline'; script-src * 'self' 'https://appssdk.zoom.us' 'unsafe-inline'; connect-src * 'self' wss://${host}/sockjs-node; img-src 'self' data: https://images.unsplash.com; base-uri 'self'; form-action 'self';`
    )
    res.setHeader('Referrer-Policy', 'same-origin')
    res.setHeader('X-Frame-Option', 'same-origin')

```

Sadly I am still getting the same error. I thought the issue might be with [ngrok not passing the headers through](https://stackoverflow.com/questions/40327672/configure-ngroks-cors-headers), but starting ngrok with the `-host-header=rewrite` did not resolve the issue either.

It would be helpful if the fail response was a little more specific as to what specific header or permission is missing. Any other idea on what I could be missing here (+ @ash.provost )?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [July 5, 2022, 9:47pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/6 "2022-07-05T21:47:03Z")

</div>

@vandalayindustries Can you send a screenshot of the headers your page is serving?

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 6, 2022, 2:47am UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/7 "2022-07-06T02:47:26Z")

</div>

Hi @MaxM ,

These are the headers on the Development “App home url”:

 ![Screen Shot 2022-07-05 at 7.38.28 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/9/b90a30d5f735d77501e755f2255c2c6cd6e6c775.png)

The POST request itself is as follows (no specific headers set [as shown in the documentation](https://marketplace.zoom.us/docs/zoom-apps/guides/in-client-oauth#enabling-in-client-oauth-for-your-app))

 ![Screen Shot 2022-07-05 at 7.42.23 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/3/c/3c5108bc0c6655e37977f980aef66db5a3301481.png)

Appreciate any insights!

---

<div class="post-metadata">

**Author:** ![daniel.fried](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@daniel.fried](https://devforum.zoom.us/u/daniel.fried)\
**Post date:** [July 6, 2022, 6:19pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/8 "2022-07-06T18:19:00Z")

</div>

@vandalayindustries Zoom’s authorization server does not allow cross origin requests, so the browser is blocking the response. You will need to make this request server-side.

Also noting the token endpoint is [https://zoom.us/oauth/token](https://zoom.us/oauth/token)

We will update the docs to clarify how to use this flow.

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 6, 2022, 8:30pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/9 "2022-07-06T20:30:37Z")

</div>

Thanks @daniel.fried , that would explain why we are running into a wall here.

I tried sending the request from the server side the same way as in the standard (not in-client) OAuth, but am getting a “Invalid authorization code” response. Specifically, posting to  
`https://zoom.us/oauth/token?grant_type=authorization_code&code=[CODE]&redirect_uri=[REDIRECT_URI]`

where the CODE and REDIRECT\_URI parameters are provided by the onAuthorized event data. Is there some other grant\_type parameter that needs to be set here or something?

---

<div class="post-metadata">

**Author:** ![daniel.fried](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@daniel.fried](https://devforum.zoom.us/u/daniel.fried)\
**Post date:** [July 7, 2022, 11:50pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/10 "2022-07-07T23:50:54Z")

</div>

Are you providing the basic auth header?

> **[Zoom Developer Docs](https://marketplace.zoom.us/docs/guides/auth/oauth/#step-2-request-access-token)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 8, 2022, 12:10am UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/11 "2022-07-08T00:10:54Z")

</div>

Hi @daniel.fried , yes I am including the basic auth header. As far as I can tell the header is set correctly. I.e. if I omit or send the incorrect header then it will give me a different error `Invalid client_id or client_secret.`

---

<div class="post-metadata">

**Author:** ![andy1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/andy1/32/34382_2.png) [@andy1](https://devforum.zoom.us/u/andy1)\
**Post date:** [July 8, 2022, 7:11pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/12 "2022-07-08T19:11:20Z")

</div>

Wild guess … does the code need to use encodeURIComponent()?

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 9, 2022, 6:41pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/13 "2022-07-09T18:41:30Z")

</div>

Good thought…just tried but sadly get the same response. Seems the code is always alphanumeric so encodeURIComponent doesn’t have any effect.

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 12, 2022, 5:28pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/14 "2022-07-12T17:28:39Z")

</div>

@daniel.fried or other Zoom folks, any other ideas why the authorization code is being rejected?

Here’s an example of a code being received onAuthorized:

 ![Screen Shot 2022-07-12 at 10.22.03 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/8/2/82ae8ee44a2aba354284cb9804ff8bd46fec1f1e.png)

And then immediately rejected. The code and redirect\_uri are identical to what is received above:

 ![Screen Shot 2022-07-12 at 10.22.59 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/8/680bab6e9eb5cd126b11be069bc117f1b400e47b.png)

---

<div class="post-metadata">

**Author:** ![njain4\_be19](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/njain4_be19/32/32782_2.png) [@njain4\_be19](https://devforum.zoom.us/u/njain4_be19)\
**Post date:** [July 13, 2022, 1:32pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/15 "2022-07-13T13:32:53Z")

</div>

have you tried adding mode:“no-cors” in request options

---

<div class="post-metadata">

**Author:** ![vandalayindustries](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vandalayindustries/32/39002_2.png) [@vandalayindustries](https://devforum.zoom.us/u/vandalayindustries)\
**Post date:** [July 13, 2022, 6:08pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/16 "2022-07-13T18:08:54Z")

</div>

Interesting idea. I just gave `mode: 'no-cors'` a try but still get the same response. Seems like the request is now making it fine to the API endpoint…the issue seems to be that it is not accepting the code provided by the onAuthorized function.

---

<div class="post-metadata">

**Author:** ![njain4\_be19](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/njain4_be19/32/32782_2.png) [@njain4\_be19](https://devforum.zoom.us/u/njain4_be19)\
**Post date:** [July 13, 2022, 6:25pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/17 "2022-07-13T18:25:42Z")

</div>

So error code 400 Bad Request is shown, i.e server is now denying the request. I have also created a custom server and am facing the same issue, the request makes fine to the server, but the server is rejecting it. I think this has something to do with the proxy.  
@daniel.fried @MaxM any solutions on this?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [July 22, 2022, 10:54pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/18 "2022-07-22T22:54:54Z")

</div>

@njain4_be19 Just to confirm, are you able to make that same request outside of the client without an issue? What steps can I take to reproduce this issue on my end?

---

<div class="post-metadata">

**Author:** ![njain4\_be19](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/njain4_be19/32/32782_2.png) [@njain4\_be19](https://devforum.zoom.us/u/njain4_be19)\
**Post date:** [July 23, 2022, 5:11pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/19 "2022-07-23T17:11:12Z")

</div>

yes I used postman to check my api it worked fine.  
So to reproduce make a fetch request to any other custom backend that you have hosted and then it will give 400 bad request on custom the backend side which means request is getting their but is rejected. I was able to find a work around by first send trigger data from inclient react app to app backend and then to my backend . I am using the advanced react sample on github to develop further

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [August 11, 2022, 6:18pm UTC](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482/20 "2022-08-11T18:18:58Z")

</div>

Sorry for the delay here. So far, I haven’t been able to reproduce this on my end. I’m glad you have a path forward but if there is a bug I want to make sure it’s addressed.

You mentioned that your custom backend returns the 400 error. Have you had a chance to capture logs from the backend?

[Next page](https://devforum.zoom.us/t/in-client-oauth-not-accepting-post-requests/71482.md?page=2)