# Invalid access token when just getting started

**URL:** <https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694>\
**Category:** API and Webhooks\
**Created:** [April 2, 2020, 6:11pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694 "2020-04-02T18:11:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pineapplejoe](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@pineapplejoe](https://devforum.zoom.us/u/pineapplejoe)\
**Post date:** [April 2, 2020, 6:11pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/1 "2020-04-02T18:11:42Z")

</div>

I am following this sample.

> <https://github.com/zoom/zoom-api-jwt/blob/master/index.js>

I generate the signature just fine.

When I test the signature at [jwt.io](http://jwt.io) it says invalid signature.

If I change any detail in the decoded part and then change it back - it presents a new and valid signature.

If I take that new signature and try and use it instead of the one I auto generate - it still fails.

What am I missing? I’ve read through a bunch of the other “invalid access token” threads (thats how I learned about jwt-io) but I dont see anything specific to this case.

---

<div class="post-metadata">

**Author:** ![pineapplejoe](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@pineapplejoe](https://devforum.zoom.us/u/pineapplejoe)\
**Post date:** [April 2, 2020, 7:02pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/2 "2020-04-02T19:02:04Z")

</div>

Resolved it. Was using SDK creds and not JWT creds. I dont really get what the difference between the two are. JWT is server side only?

Anyways - appears to be working.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 3, 2020, 1:03am UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/3 "2020-04-03T01:03:18Z")

</div>

Happy to hear you figured out the issue! 🙂

Yes, you must use [JWT](https://marketplace.zoom.us/docs/guides/getting-started/app-types/create-jwt-app) for the [Web SDK](https://marketplace.zoom.us/docs/sdk/native-sdks/web) because it is web based.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![pineapplejoe](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@pineapplejoe](https://devforum.zoom.us/u/pineapplejoe)\
**Post date:** [April 3, 2020, 1:06am UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/4 "2020-04-03T01:06:14Z")

</div>

Ohh. So SDK creds are for the native APIs. Got it.

Thanks.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [April 3, 2020, 6:01am UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/5 "2020-04-03T06:01:19Z")

</div>

Yep! 🙂

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 8:18pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-just-getting-started/10694/6 "2020-08-21T20:18:34Z")

</div>

Closed on August 21, 2020, 8:18pm UTC