# "Invalid api key or secret" error in Server-to-Server OAuth app

**URL:** <https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579>\
**Category:** Authentication\
**Created:** [July 20, 2022, 7:43pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579 "2022-07-20T19:43:15Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 20, 2022, 7:43pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/1 "2022-07-20T19:43:15Z")

</div>

I’m trying to use curl to run an activity report. I can get the token from Zoom but when I try to use the it I get the error "Invalid api key or secret ". I’m doing this with a Server-to-Server OAuth setup since this will eventually run in the background on a server. How do I get past the error?

Here’s the sanitized version of how I get the token. The instructions for Server-to-Server OAuth say to use “account\_credentials” for the grant\_type but that fails with “unsupported grant type”.

```auto
$ curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' -H 'Authorization: Basic base64encodedidandsecret==' 'https://zoom.us/oauth/token?grant_type=client_credentials&account_id=myaccountid' 2>/dev/null| jq .
{
  "access_token": "reallongaccesstoken",
  "token_type": "bearer",
  "expires_in": 3600,
  "scope": "account:master account:read:admin group:master group:read:admin report:master report:read:admin role:read:admin user:master user:read:admin"
}

```

When I then try to use the token I get the error:

```auto
$ curl -H 'Accept: application/json' -H 'Authorization: Bearer reallongaccesstoken' 'https://api.zoom.us/v2/report/activities'
{"code":200,"message":"Invalid api key or secret."}

```

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 20, 2022, 10:33pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/2 "2022-07-20T22:33:45Z")

</div>

Hi @beirne  
Hope you are doing great?  
It looks like you are passing the wrong grant\_type in your url, it should be account\_credentials and you are passing client\_credentials

Could you please double check that and confirm if that fixes the issue?  
Thanks  
Elisa

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 12:11pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/3 "2022-07-21T12:11:25Z")

</div>

Thanks @elisa.zoom, I had tried account\_credentials first but it did not work. Here’s what I get back from it:

```auto
$ curl -s -X POST -H 'Content-Type: application/x-www-form-urlencoded' -H 'Authorization: Basic base64encodedidandsecret==' 'https://zoom.us/oauth/token?grant_type=account_credentials&account_id=myaccountid' | jq .
{
  "reason": "unsupported grant type",
  "error": "unsupported_grant_type"
}

```

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 6:51pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/4 "2022-07-21T18:51:10Z")

</div>

Hey @beirne  
What endpoint are you trying to call?

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 6:58pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/5 "2022-07-21T18:58:03Z")

</div>

Hi @elisa.zoom  
If I understand endpoint correctly, it’s `https://api.zoom.us/v2/report/activities`, as I showed in the second example in my original post.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 7:26pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/6 "2022-07-21T19:26:54Z")

</div>

could you try something like this:  
curl -s -X POST -H 'Authorization: Basic ‘cliendId:clientSecret encoded '[https://zoom.us/oauth/token?grant\_type=account\_credentials&account\_id={accountID}’](https://zoom.us/oauth/token?grant_type=account_credentials&account_id=%7BaccountID%7D%E2%80%99)

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 7:33pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/7 "2022-07-21T19:33:55Z")

</div>

If I just change account to client before \_credentials the query works fine:

> $ curl -s -X POST -H ‘Authorization: Basic base64encodedidandsecret==’ ‘[https://zoom.us/oauth/token?grant\_type=client\_credentials&account\_id={accountID}](https://zoom.us/oauth/token?grant_type=client_credentials&account_id=%7BaccountID%7D)’ | jq .  
> {  
> “access\_token”: “reallylongtokenstring”,  
> “token\_type”: “bearer”,  
> “expires\_in”: 3600,  
> “scope”: “account:master account:read:admin group:master group:read:admin report:master report:read:admin role:read:admin user:master user:read:admin”  
> }

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 7:51pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/8 "2022-07-21T19:51:02Z")

</div>

Right, have you rpelaced the “base64encodedidandsecret” for your actual encoded clientID and secret and the accountID with the accountID associated to your Server to Server app?

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 7:51pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/9 "2022-07-21T19:51:40Z")

</div>

@beirne  
Interesting, Its working on my end

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 7:53pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/10 "2022-07-21T19:53:27Z")

</div>

I built the base64encodedidandsecret by doing ‘echo “clientid:clientsecret” | base64’, with the two client fields filled in. I then pasted the result into the Authorization header parameter for curl. The same credential works fine for the client\_credentials.

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 7:56pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/11 "2022-07-21T19:56:18Z")

</div>

@elisa.zoom Could it be something in the account configuration? We were pretty much figuring it out from the web page and maybe missed something. Aside from going through and reading the instructions really carefully, do you have any ideas on what might cause this? By googling I found others with the same problem but unfortunately no posted solution.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 8:06pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/12 "2022-07-21T20:06:57Z")

</div>

No, Its quite interesting to me cause I have not been able to replicate this issue on my end.  
I wrote this guide about a month ago, maybe it can help you troubleshoot the error:

> [@How to user Server-to-Sever OAuth app with Postman](https://devforum.zoom.us/t/how-to-user-server-to-sever-oauth-app-with-postman/70848):
>
> How to use our Server-to-Server OAuth with Postman? As some of you might be aware of, our JWT app is being deprecated by June 2023 and we encourage you to migrate to the newly introduced [Server-to-Server OAuth App](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app) That being said, here is a quick and simple guide on how to use or new app with Postman As stated in our documentation here: This new app type facilitates OAuth-authenticated requests between servers without end-user involvement. And this grant type enable your private server a…

Let me know if it helps!  
Best,  
Elisa

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 21, 2022, 8:43pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/13 "2022-07-21T20:43:06Z")

</div>

@elisa.zoom, your guide for Postman is good. I just vaguely know how to use it and I set up the query pretty quickly. Unfortunately I get the same results. It works with client\_credentials and does not work with account\_credentials. The responses are the same as what I get with curl, so I won’t post them here.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 21, 2022, 8:47pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/14 "2022-07-21T20:47:32Z")

</div>

Very very interesting @beirne  
I am going to send you a DM so we can set up a call or exchange more details!  
🙂

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 22, 2022, 5:14pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/15 "2022-07-22T17:14:52Z")

</div>

After some debugging together, we figured it out @beirne !!!

Here are some steps to debug and fix this issue if you are getting the same error

1. Make sure that you have the right permissions enabled in your account to be able to user the Server-to-Server OAuth app, you can do so in the Web Portal, by going to User Management \> Roles \> Role Settings \> Advanced features (this can only be done by an Administrator or the Owner of the account)

 ![Screen Shot 2022-07-22 at 1.13.27 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/5/6/56a9f2e2ff96f2081bad01355417d9504bb5ded1.jpeg)

1. Make sure that your application is a Server-to-Server OAuth app in the Marketplace (here is a link to our Docs: [Create a Server-to-Server OAuth App](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/#create-a-server-to-server-oauth-app))

 ![Screen Shot 2022-07-22 at 9.29.10 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/9/b9aca6da18dd605e38267d7d1425605b6c4edf65.png)

1. Last but not least, every time you make any changes to your app (like adding scopes or features) make sure to activate the app in your account.

Hope this helps!  
Elisa

---

<div class="post-metadata">

**Author:** ![beirne](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@beirne](https://devforum.zoom.us/u/beirne)\
**Post date:** [July 22, 2022, 5:17pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/16 "2022-07-22T17:17:33Z")

</div>

Thank you @elisa.zoom ! This solved a big mystery and got it working. I appreciate your help and the instructions.

---

<div class="post-metadata">

**Author:** ![alexwolf](https://avatars.discourse-cdn.com/v4/letter/a/dbc845/32.png) [@alexwolf](https://devforum.zoom.us/u/alexwolf)\
**Post date:** [July 28, 2022, 12:57am UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/17 "2022-07-28T00:57:17Z")

</div>

Thank You so much for sharing[.](https://thealightmotion.com/alight-motion-pro-apk/)

---

<div class="post-metadata">

**Author:** ![apkmily1122](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/apkmily1122/32/34178_2.png) [@apkmily1122](https://devforum.zoom.us/u/apkmily1122)\
**Post date:** [July 28, 2022, 7:14pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/18 "2022-07-28T19:14:35Z")

</div>

Thank You so much for the valuable information[.](https://apkmily.com/download-ludo-club-apk/) Much appreciated.

---

<div class="post-metadata">

**Author:** ![ahsanali1821142](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ahsanali1821142/32/39907_2.png) [@ahsanali1821142](https://devforum.zoom.us/u/ahsanali1821142)\
**Post date:** [July 29, 2022, 5:08pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/19 "2022-07-29T17:08:56Z")

</div>

I have been working on a Laravel project that provides online education to students. I wanted to use Zoom services of video conferencing so that the teacher can connect with their students through video conference. Following the API reference documentation, I have registered an app with Zoom[.](https://bit.ly/3oDzpe4) I got an API key and API secret along with an access token by following the documentation.

I am sending subsequent requests to post/fetch data from Zoom, but I have been getting an error message

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [July 29, 2022, 9:22pm UTC](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579/20 "2022-07-29T21:22:59Z")

</div>

Hey @ahsanali1821142  
Feel free to open up a new Topic since this one is closed 🙂  
Cheers,  
Elisa

[Next page](https://devforum.zoom.us/t/invalid-api-key-or-secret-error-in-server-to-server-oauth-app/72579.md?page=2)