# Incorrect client-id/secret

**URL:** <https://devforum.zoom.us/t/incorrect-client-id-secret/116457>\
**Category:** API and Webhooks\
**Tags:** api\
**Created:** [August 27, 2024, 10:31am UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457 "2024-08-27T10:31:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterculazh](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/peterculazh/32/62811_2.png) [@peterculazh](https://devforum.zoom.us/u/peterculazh)\
**Post date:** [August 27, 2024, 10:31am UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/1 "2024-08-27T10:31:49Z")

</div>

Hello, previously on other account I created app on marketplace and successfully  
authenticated by Server-to-Server OAuth and were getting access token a few days.

And today with same credentials I can’t to get access token, nothing has changed for credentials during that period while were researching API. Now I’m getting 400 response status and body:

```auto
{
    "reason": "Invalid client_id or client_secret",
    "error": "invalid_client"
}

```

I tried to regenerate client secret at app page and I’m getting message `fail_to_regenerate_secret` and at network it shows 500 response status.

Created another app and there everything is working fine, but not sure what caused that issue and after that issue basically I can’t use that application and have to move every scopes from first app to second app.

Thanks

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [August 27, 2024, 3:56pm UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/2 "2024-08-27T15:56:33Z")

</div>

Hi @peterculazh  
Thanks for reaching out to us.  
Could you make sure that you are using the account\_credentials as the grant type?  
You can check out this guide to make sure you are making the request correctly:

> [@How to user Server-to-Sever OAuth app with Postman](https://devforum.zoom.us/t/how-to-user-server-to-sever-oauth-app-with-postman/70848):
>
> How to use our Server-to-Server OAuth with Postman? As some of you might be aware of, our JWT app is being deprecated by June 2023 and we encourage you to migrate to the newly introduced [Server-to-Server OAuth App](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app) That being said, here is a quick and simple guide on how to use or new app with Postman As stated in our documentation here: This new app type facilitates OAuth-authenticated requests between servers without end-user involvement. And this grant type enable your private server a…

---

<div class="post-metadata">

**Author:** ![peterculazh](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/peterculazh/32/62811_2.png) [@peterculazh](https://devforum.zoom.us/u/peterculazh)\
**Post date:** [August 28, 2024, 4:58am UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/3 "2024-08-28T04:58:10Z")

</div>

Hello, checked and `grant_type: "account_credentials"` is always were there once I did first successful authentications a few days ago.

Issue still persist for first application and I described details in first message, there code that I did just for researching how to do s2s ouath:

```auto
const main = async () => {
  const clientID = `...`;
  const clientSecret = `...`;

  const clientIdSecretBase64 = Buffer.from(
    `${clientID}:${clientSecret}`
  ).toString("base64");

  const response = await axios.post(
    "https://zoom.us/oauth/token",
    {
      grant_type: "account_credentials",
      account_id: `...`,
    },
    {
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
        Authorization: `Basic ${clientIdSecretBase64}`,
      },
    }
  );

  console.log(response);
};

main();

```

So both with that code or Postman, for first application I’m getting 400 status (and 500 status for regenerating client secret) and for second application I receiving access token as expected. But there no way to get 400 status on first app cuz I’m using correct credentials (copy-pasting every time)

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [August 28, 2024, 7:06am UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/4 "2024-08-28T07:06:16Z")

</div>

@peterculazh I’m doing something like this, hope it helps

```auto
// Function to fetch a bearer token
async function fetchBearerToken() {
  try {
    // Create a Basic Authorization header with client credentials
    const credentials = Buffer.from(`${process.env.ZOOM_S2S_CLIENT_ID}:${process.env.ZOOM_S2S_CLIENT_SECRET}`).toString('base64');
    const apiUrl = `https://zoom.us/oauth/token?grant_type=account_credentials&account_id=${process.env.ZOOM_S2S_ACCOUNTID}`;
    
    // Define the token request parameters
    const tokenRequestData = {
      method: 'POST',
      url: apiUrl,
      headers: {
        'Authorization': `Basic ${credentials}`,
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      
    };

    // Send the token request
    const response = await axios(tokenRequestData);

    // Extract the access token from the response
    const accessToken = response.data.access_token;
    // Return 
    return accessToken;
   
  } catch (error) {
    return error.message;
  }
}

```

---

<div class="post-metadata">

**Author:** ![peterculazh](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/peterculazh/32/62811_2.png) [@peterculazh](https://devforum.zoom.us/u/peterculazh)\
**Post date:** [September 20, 2024, 6:48am UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/5 "2024-09-20T06:48:25Z")

</div>

Hello, thanks for responses. As I said, code was working fine and started at some moment receiving 400 status and message `Invalid client_id or client_secret` without changing code.

Today I faced same issue on another application that I’ve created at same day as first application broke and started receiving 500 status too while trying to regenerate `client secret` or change `scope`.

I’m not sure how I achieved to broke application, because used just a few endpoints: Server-to-Server OAuth, creating/deleting meetings endpoints and once used endpoint for receiving ZAK token for specified account.

---

<div class="post-metadata">

**Author:** ![enlace.gossler](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/enlace.gossler/32/66472_2.png) [@enlace.gossler](https://devforum.zoom.us/u/enlace.gossler)\
**Post date:** [January 17, 2025, 9:37pm UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/6 "2025-01-17T21:37:38Z")

</div>

Hi there.

I have exactly de same problem, the app works fine and suddently just get broken. Could you solve this ???

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [January 21, 2026, 1:14pm UTC](https://devforum.zoom.us/t/incorrect-client-id-secret/116457/7 "2026-01-21T13:14:20Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.