# Invalid authorization code with PKCE

**URL:** <https://devforum.zoom.us/t/invalid-authorization-code-with-pkce/51995>\
**Category:** API and Webhooks\
**Created:** [June 8, 2021, 11:19am UTC](https://devforum.zoom.us/t/invalid-authorization-code-with-pkce/51995 "2021-06-08T11:19:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AJW](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ajw/32/27775_2.png) [@AJW](https://devforum.zoom.us/u/AJW)\
**Post date:** [June 8, 2021, 11:19am UTC](https://devforum.zoom.us/t/invalid-authorization-code-with-pkce/51995/1 "2021-06-08T11:19:03Z")

</div>

**Description**

Our OAuth flow worked prior to adding PKCE support, this is part 2 of [https://devforum.zoom.us/t/pkce-code-challenge-method-not-supported/51510](https://devforum.zoom.us/t/pkce-code-challenge-method-not-supported/51510)

The redirection is followed and I have a code, so I’m now at step 2 attempting to submit the code to get an access token: [https://marketplace.zoom.us/docs/guides/auth/oauth#step-2-request-access-token](https://marketplace.zoom.us/docs/guides/auth/oauth#step-2-request-access-token)

but the endpoint `https://zoom.us/oauth/token` returns “reason”:“Invalid authorization code {code}”,“error”:“invalid\_request”

**Which App Type (OAuth / Chatbot / JWT / Webhook)?**  
OAuth

**Which Endpoint/s?**  
`https://zoom.us/oauth/token`

**How To Reproduce (If applicable)**  
Steps to reproduce the behavior:

1. GET `https://zoom.us/oauth/authorize?response_type=code&state={state}&code_challenge={code_challenge}&code_challenge_method=sha256&client_id={client_id}&redirect_uri={redirect_uri}`

2. Redirect / 302 to {redirect\_uri}?code={code}&state={state}

3. POST `https://zoom.us/oauth/token`  
in body as (application/x-www-form-urlencoded):  
grant\_type=authorization\_code  
code={code}  
code\_verifier={code\_verifier}  
redirect\_uri={redirect\_uri}

I’ve also tried encoding all parameters in the Url (as suggested in another post), but the response is the same “Invalid authorization code”:

POST `https://zoom.us/oauth/token?grant_type=authorization_code&code={code}&code_verifier={code_verifier}&redirect_uri={redirect_uri}`

_ **Update:** _  
I’ve refined my code changes so the only differences between an oauth flow that I’ve confirmed works\* and the above steps are:  
Calling `https://zoom.us/oauth/authorize` - add code\_challenge and code\_challenge\_method parameters  
Calling `https://zoom.us/oauth/token` add code\_verifier

\*Authorization / Content-Type are correct etc

so the problem does seem to be PKCE-related?

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [June 9, 2021, 5:20pm UTC](https://devforum.zoom.us/t/invalid-authorization-code-with-pkce/51995/2 "2021-06-09T17:20:54Z")

</div>

Hey @AJW,

Thank you for reaching out to the Zoom Developer Forum. I’m tracking an issue similar to this but based on initial information, yours seems to be a bit different.

Please send an email to [developersupport@zoom.us](mailto:developersupport@zoom.us) with a link to this thread. In that email, please include the token URL that you’re using as well as the authorization header. I’ll use that to investigate further.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [July 10, 2021, 3:21am UTC](https://devforum.zoom.us/t/invalid-authorization-code-with-pkce/51995/3 "2021-07-10T03:21:42Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.