# Invalid Grant Type for Oauth app using PHP **URL:** \ **Category:** Authentication\ **Created:** [April 21, 2023, 8:20pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191 "2023-04-21T20:20:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [April 21, 2023, 8:20pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/1 "2023-04-21T20:20:11Z")
Following the documentation provided [here](https://developers.zoom.us/docs/integrations/oauth/#getting-an-access-token) Step 1, I am acquiring an authorization code from authorize endpoint. On step 2 I am hitting this endpoint: [https://zoom.us/oauth/token](https://zoom.us/oauth/token) and passing the value from step 1 to the `code` field. I am passing “grant\_type” as “authorization\_code”. Here is the response being provided: {“reason”:“unsupported grant type”,“error”:“unsupported\_grant\_type”} Why is it saying “unsupported grant type?” This is exactly what the docs instruct you to do. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 27, 2023, 8:11pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/2 "2023-04-27T20:11:29Z")
Hi @alanj Thanks for reaching out to us and welcome to our community! Have you been able to identify your issue here? are you still having trouble getting your access\_token via OAuth? ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 1, 2023, 4:47pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/3 "2023-05-01T16:47:27Z")
I have not resolved this and get the same error. ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 1, 2023, 4:58pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/4 "2023-05-01T16:58:08Z")
@elisa.zoom adding this to make sure you get tagged ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [May 1, 2023, 5:12pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/5 "2023-05-01T17:12:06Z")
Hey @alanj could you please confirm if you are using credentials associated with an OAuth app? ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 1, 2023, 5:21pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/6 "2023-05-01T17:21:35Z")
@elisa.zoom yes, this is confirmed ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [May 1, 2023, 5:28pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/7 "2023-05-01T17:28:03Z")
Thanks @alanj Here is a very helpful post on how to use Oauth with postman: > [@Guide: Making a Zoom API Call with OAuth Credentials in Postman](https://devforum.zoom.us/t/guide-making-a-zoom-api-call-with-oauth-credentials-in-postman/64538): > > To publish an app on the Zoom Marketplace you must create an [OAuth app](https://marketplace.zoom.us/docs/guides/build/oauth-app/). When you’re ready to test making API calls, download the latest version of Postman and import the Zoom API collections following the steps outlined [here](https://marketplace.zoom.us/docs/guides/guides/postman/using-postman-to-test-zoom-apis/). There are Three Ways to Set up OAuth in Postman to Make API Requests We’re going to go through three ways to set up our OAuth application credentials to successfully authorize and access the Zoom API to make requests. The “Easy” Difficulty OAuth 2.0 Set Up in Postman We’… If you can follow along, you might be able to identify the issue ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 1, 2023, 5:34pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/8 "2023-05-01T17:34:25Z")
@elisa.zoom This is nothing like the zoom guide I have been following in the slightest. Why isn’t the flow I linked in the original post not working? The guide you linked does not even use the same endpoints and is entirely at odds with the documentation. ---
**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\ **Post date:** [May 1, 2023, 7:04pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/9 "2023-05-01T19:04:27Z")
Hi @alanj , _Edit_: I’ve just edited the above guidance to include the up to date information for manual OAuth authorization. Please reference our Postman workspace which accurately conveys what’s shared in our docs: [https://www.postman.com/zoom-developer/workspace/zoom-public-workspace/request/22097587-82698a23-7af5-4f3f-bf2e-a62c3eb8903d](https://www.postman.com/zoom-developer/workspace/zoom-public-workspace/request/22097587-82698a23-7af5-4f3f-bf2e-a62c3eb8903d) ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/3/7/3779577b6a2387c816d0f6aef4043a3954af1cc1.png) ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 3:29pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/10 "2023-05-02T15:29:03Z")
@gianni.zoom I am still getting the same error after switching to a user level app and following the postman steps - I can obtain an authorization code just fine, but when I send that value in the `code` to the `token` endpoint, I receive an error in JSON that says `unsupported grant type.` It is also unclear why the endpoint asks for a `redirect_uri`, when the endpoint should simply return the access token and not redirect the user. The server itself is making this call, not the customer. ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [May 2, 2023, 3:50pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/11 "2023-05-02T15:50:40Z")
Are you creating an [OAuth application](https://developers.zoom.us/docs/integrations/) or a [Server-to-Server OAuth application](https://developers.zoom.us/docs/internal-apps/)? OAuth applications usually use a `grant_type` value of `authorization_code` and a Server-to-Server OAuth application uses a `grant_type` value of `account_credentials`. Make sure to format the request body as a query string to align with the `Content-Type: application/x-www-form-urlencoded` header you’re passing. I feel that the [OAuth 2.0 for user authorized apps](https://developers.zoom.us/docs/integrations/oauth/) walkthrough is providing misleading examples of what your request should look like. ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 4:00pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/12 "2023-05-02T16:00:23Z")
I have switched to an Oauth user level app. I am passing the correct headers and values (`authorization_code`). I still receive the error. ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [May 2, 2023, 4:07pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/13 "2023-05-02T16:07:24Z")
Can you provide a code snippet of how you’re producing the request to `https://zoom.us/oauth/token`? I’m particularly interested in the headers are being prepared and how the body is being generated. Our application is sending `Content-Type: application/x-www-form-urlencoded; charset=utf-8` and using PHP’s `http_build_query` function to produce the query string which should yield a body like `grant_type=authorization_code&code=&redirect_uri=`. ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 4:14pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/14 "2023-05-02T16:14:55Z")
The docs say multiple times NOT to pass the grant\_type or redirect URI through the query string. (However, I tried it, and it gives the same result.) I am using php’s curl library. Firstly, function for generating post fields (omitting signature for redundancy) ```auto return [ "code" => $authCode, "grant_type" => "authorization_code", "redirect_uri" => Yii::$app->params["zoom"]["auth"]["redirect_url"], ]; ``` Generating the headers: ```auto return [ "Authorization: " . AuthUtil::getAuthorizationHeader(), "Content-Type: application/x-www-form-urlencoded", ]; ``` Lastly, the actual calling functions (functions here call the above), $p and $q variables are for debugging purpose ```auto $curl = curl_init(Yii::$app->params["zoom"]["auth"]["access_token"]); curl_setopt($curl, CURLOPT_POST, true); curl_setopt($curl, CURLOPT_POSTFIELDS, $p = AuthUtil::getAccessTokenPost($authCode)); curl_setopt($curl, CURLOPT_HTTPHEADER, $q = AuthUtil::getAccessTokenHeaders()); curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); curl_setopt($curl, CURLINFO_HEADER_OUT, true); $data = curl_exec($curl); $info = curl_getinfo($curl); if ($info["http_code"] != 200) { Yii::debug($info); Yii::debug($data); curl_close($curl); return null; } curl_close($curl); return json_decode($data); ``` ---
**Author:** ![vasilca.matei.ovidiu](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vasilca.matei.ovidiu/32/48123_2.png) [@vasilca.matei.ovidiu](https://devforum.zoom.us/u/vasilca.matei.ovidiu)\ **Post date:** [May 2, 2023, 4:18pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/15 "2023-05-02T16:18:18Z")
just so you know, i am waiting too for a solution in this case 😃 ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [May 2, 2023, 4:24pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/16 "2023-05-02T16:24:07Z")
Per the PHP documentation for [`curl_setopt`](https://www.php.net/manual/en/function.curl-setopt)’s `CURLOPT_POSTFIELDS`, I’m concerned that you are taking a contradictory position on `Content-Type` where passing a PHP array implies a `Content-Type` of `multipart/form-data` (which I don’t think Zoom officially accepts), while you are intending to use `application/x-www-form-urlencoded` (which Zoom is known to accept). Can you verify the actual headers that are being sent? ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 4:25pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/17 "2023-05-02T16:25:32Z")
I can confirm the proper header is being sent, by debugging the $info variable: ```auto Host: zoom.us Accept: */* Authorization: Basic [[REDACTED]] Content-Length: 453 Content-Type: application/x-www-form-urlencoded; boundary=------------------------39dea308112275e8 ``` ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [May 2, 2023, 4:27pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/18 "2023-05-02T16:27:09Z")
The inclusion of a `boundary` keyword suggests you are triggering residual behavior from `multipart/form-data`. ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 4:31pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/19 "2023-05-02T16:31:33Z")
Per php’s curl documentation, if `CURLOPT_POSTFILEDS` is set to an array, then boundary is automatically set and the `multipart/form-data` is set as well. I will try passing in `&` delimited parameters and get back to you very shortly. ---
**Author:** ![alanj](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@alanj](https://devforum.zoom.us/u/alanj)\ **Post date:** [May 2, 2023, 4:34pm UTC](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191/20 "2023-05-02T16:34:57Z")
@MultiplayerSession that did it! PHP does not permit the overriding of the header. I assumed that the boundary would be necessary after all. @vasilca.matei.ovidiu if you are using php, pass in a string rather than an array to `CURLOPT_POSTFIELDS`. [Next page](https://devforum.zoom.us/t/invalid-grant-type-for-oauth-app-using-php/87191.md?page=2)