# Invalid access token when trying to call the REST API

**URL:** <https://devforum.zoom.us/t/invalid-access-token-when-trying-to-call-the-rest-api/135377>\
**Category:** API and Webhooks\
**Tags:** api\
**Created:** [July 17, 2025, 11:16pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-trying-to-call-the-rest-api/135377 "2025-07-17T23:16:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dev\_lxpead](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dev_lxpead/32/63797_2.png) [@dev\_lxpead](https://devforum.zoom.us/u/dev_lxpead)\
**Post date:** [July 17, 2025, 11:16pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-trying-to-call-the-rest-api/135377/1 "2025-07-17T23:16:52Z")

</div>

I implemented the API call to create a Webinar. I’m using this code snippet to generate the JWT:

```auto
import { NextRequest, NextResponse } from "next/server";
import { KJUR } from "jsrsasign";

export async function POST(req: NextRequest) {
  const { userId, data } = await req.json();

  const apiKey = process.env.NEXT_PUBLIC_ZOOM_MEETING_SDK_KEY_ADMIN;
  const apiSecret = process.env.ZOOM_MEETING_SDK_SECRET_ADMIN;
  if (!apiKey || !apiSecret) {
    return NextResponse.json(
      { error: "Zoom API Key/Secret não configurados." },
      { status: 500 }
    );
  }

  const iat = Math.floor(Date.now() / 1000);
  const exp = iat + 60 * 5;
  const header = { alg: "HS256", typ: "JWT" };
  const payload = { iss: apiKey, exp };
  const jwt = KJUR.jws.JWS.sign(
    "HS256",
    JSON.stringify(header),
    JSON.stringify(payload),
    apiSecret
  );

  const zoomResp = await fetch(
    `https://api.zoom.us/v2/users/${userId}/webinars`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${jwt}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(data),
    }
  );

  const result = await zoomResp.json();
  return NextResponse.json(result, { status: zoomResp.status });
}

```

The body I’m sending in the request is this:

```auto
{
    "userId": "lxpeadservices@gmail.com",
    "data": {
        "topic": "Webinar Teste Yan",
        "settings": {
            "question_and_answer": {
                "enable": true
            }
        }
    }
}

```

The JWT is successfully created, but when I send the API call, this error is returned:  
`{"code":124,"message":"Invalid access token."}`

I’m using an account that has webinar access and permissions. I also created an Admin-managed app in the marketplace with webinar scopes and all users enabled.  
App ID: JVFLSJtaTKiJdxhnisRfQw

The credentials I am using to generate the JWT are the Client ID and Client Secret provided in the app.

 ![Captura de tela 2025-07-17 201504](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/2/a/2a9388a9b8b80c08f7732cebdd3fb706456eb0ed.png)

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 18, 2025, 6:27pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-trying-to-call-the-rest-api/135377/2 "2025-07-18T18:27:16Z")

</div>

Hi @dev_lxpead  
Thanks for reaching out to us and welcome to the Zoom Developer forum.  
The issue you are seeing is expected, JWT tokens are no longer supported for accessing the REST API.  
To generate an access token to call the Zoom API, you have two options.:

1. Using a Server to Server Oauth app, that allows you to generate access token without having to authorize an app on your end

> **[Internal apps (Server-to-server)](https://developers.zoom.us/docs/internal-apps/)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

> **[Server-to-Server OAuth](https://developers.zoom.us/docs/internal-apps/s2s-oauth/#generate-access-token)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

> **[GitHub - zoom/server-to-server-oauth-token: Utility script to generate a Zoom Server-to-Server...](https://github.com/zoom/server-to-server-oauth-token)**
>
> Utility script to generate a Zoom Server-to-Server Oauth Token and copy to clipboard

1. General oauth app, this requires user authorization on yor end to generate an access token.

> **[Integrations (OAuth apps)](https://developers.zoom.us/docs/integrations/)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

> **[OAuth for user authorized apps](https://developers.zoom.us/docs/integrations/oauth/#request-an-access-token)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

> **[GitHub - zoom/zoom-oauth-sample-app: Sample Zoom Oauth App NodeJS app to call Zoom's...](https://github.com/zoom/zoom-oauth-sample-app)**
>
> Sample Zoom Oauth App NodeJS app to call Zoom's APIs

Let me know if this helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [July 19, 2025, 6:27pm UTC](https://devforum.zoom.us/t/invalid-access-token-when-trying-to-call-the-rest-api/135377/3 "2025-07-19T18:27:36Z")

</div>

Closed on July 19, 2025, 6:27pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.