# Invalid\_grant on every token exchange

**URL:** <https://devforum.zoom.us/t/invalid-grant-on-every-token-exchange/146319>\
**Category:** Zoom Apps\
**Created:** [September 9, 2026, 9:15am UTC](https://devforum.zoom.us/t/invalid-grant-on-every-token-exchange/146319 "2026-09-09T09:15:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![greymatter](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/greymatter/32/76543_2.png) [@greymatter](https://devforum.zoom.us/u/greymatter)\
**Post date:** [September 9, 2026, 9:15am UTC](https://devforum.zoom.us/t/invalid-grant-on-every-token-exchange/146319/1 "2026-09-09T09:15:31Z")

</div>

Description  
Our Zoom App’s in-client OAuth (zoomSdk.authorize() with PKCE) consistently fails the token exchange with invalid\_grant, on every single attempt, with no variation. We’ve spent several hours ruling out every client/config-side cause we could find (see below) and are stuck on what’s left to check that would only be visible from Zoom’s backend.

Note: I searched the forum first and found the existing thread on the SDK v0.16.x “plain vs S256” PKCE default — our implementation already matches that fix (code\_challenge === code\_verifier), so that’s not the cause here.

How To Reproduce  
Authentication method / app type: Zoom App, in-client OAuth (zoomSdk.authorize + onAuthorized), PKCE “plain” method, SDK v0.16.0. App is User-managed, Development status (not yet through Beta Test or Publish).

1. Steps:

2. Error: Every attempt (dozens, over several hours) returns HTTP 400 `{"error":"invalid_grant","reason":"Invalid Grant"}`, within 50-200ms of the code being issued — first attempt, never a retry.

Already ruled out:

- redirect\_uri byte-exact match (confirmed via dashboard, exported app manifest, and direct request instrumentation) — no trailing slash, no encoding mismatch
- client\_id confirmed identical between server config and Marketplace App Credentials
- client\_secret regenerated and re-synced to rule out drift
- No custom OAuth/API base URL overrides in our code — the real zoom dot us / api dot zoom dot us hosts are used [it wouldn’t let me post with links]
- Required scopes present and approved: zoomapp:inmeeting, user:read:user, meeting:read:meeting
- All Zoom App SDK APIs enabled including authorize, onAuthorized, getUserContext
- code and code\_verifier confirmed byte-exact (correct lengths, clean charset) via direct instrumentation
- Code reuse ruled out directly — three separate authorize() calls produced three distinct codes (compared via hash), each exchanged exactly once
- Tried the account’s “Shared Access Permissions” toggle both checked and unchecked, combined with both a lighter re-authorization and a full app remove+reinstall — all four combinations produce the identical error

Zoom Technical Support (chat + a human agent) said this is “configuration-related, not a product defect” but couldn’t identify what, and closed the case.

Has anyone seen invalid\_grant persist through all of the above for an in-client Zoom Apps OAuth flow specifically? Is there a known constraint for apps still in Development status, or anything else Zoom-side that wouldn’t be visible from the app/client side?

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [September 11, 2026, 3:33am UTC](https://devforum.zoom.us/t/invalid-grant-on-every-token-exchange/146319/2 "2026-09-11T03:33:25Z")

</div>

@greymatter can you try without redirect\_uri?

---

<div class="post-metadata">

**Author:** ![greymatter](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/greymatter/32/76543_2.png) [@greymatter](https://devforum.zoom.us/u/greymatter)\
**Post date:** [October 8, 2026, 9:31pm UTC](https://devforum.zoom.us/t/invalid-grant-on-every-token-exchange/146319/3 "2026-10-08T21:31:16Z")

</div>

Thanks very much, @chunsiong.zoom