# Invalid Signature Help

**URL:** <https://devforum.zoom.us/t/invalid-signature-help/72496>\
**Category:** Meeting SDK\
**Created:** [July 19, 2022, 1:46pm UTC](https://devforum.zoom.us/t/invalid-signature-help/72496 "2022-07-19T13:46:30Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 19, 2022, 1:46pm UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/1 "2022-07-19T13:46:30Z")

</div>

Hi All,

Hoping someone can help me with my VUE.JS and [ASP.NET](http://ASP.NET) C# project.

So, I’m testing the zoom meetings SDK for Vue.JS.

Now for this to work I need a signature end point.

In order to get a signature end point I need a meeting room number.

In order to get a meeting room number I need an OAUTH token.

In order to get an OAUTH token I need a valid code from the App I’ve created in my account.

So, having jumped through the above hoops, I get to the point of creating a signature endpoint and when I click a button to enter a meeting room I get signature invalid.

I do know having checked multiple times that I’m using the correct SDK client key and secret from the App account so it’s not that.

I’m coding everything back end in [ASP.NET](http://ASP.NET) C# and can extract an App code, get an OAUTH token, create a meeting room, create a signature but it’s invalid.

Can anyone shed any light on why this may be.

Signature code:

```auto
    [AllowAnonymous]
        [HttpGet]
        [Route("getsignature")]
        public IHttpActionResult GetSignature(string meetingNumber)
        {
            string apiKey = "xxx";
            string apiSecret = "xxx";
            String ts = (ToTimestamp(DateTime.UtcNow.ToUniversalTime()) - 30000).ToString();
            string role = "0";
            string sig = GenerateToken(apiKey, apiSecret, meetingNumber, ts, role);
            return Ok(sig);
        }

        public static long ToTimestamp(DateTime value)
        {
            long epoch = (value.Ticks - 621355968000000000) / 10000;
            return epoch;
        }
        public static string GenerateToken(string apiKey, string apiSecret, string meetingNumber, string ts, string role)
        {
            char[] padding = { '=' };
            string message = String.Format("{0}{1}{2}{3}", apiKey, meetingNumber, ts, role);
            apiSecret = apiSecret ?? "";
            var encoding = new System.Text.ASCIIEncoding();
            byte[] keyByte = encoding.GetBytes(apiSecret);
            byte[] messageBytesTest = encoding.GetBytes(message);
            string msgHashPreHmac = System.Convert.ToBase64String(messageBytesTest);
            byte[] messageBytes = encoding.GetBytes(msgHashPreHmac);
            using (var hmacsha256 = new HMACSHA256(keyByte))
            {
                byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
                string msgHash = System.Convert.ToBase64String(hashmessage);
                string token = String.Format("{0}.{1}.{2}.{3}.{4}", apiKey, meetingNumber, ts, role, msgHash);
                var tokenBytes = System.Text.Encoding.UTF8.GetBytes(token);
                return System.Convert.ToBase64String(tokenBytes).TrimEnd(padding);
            }
        }

```

Front end enter room trigger is from meetingsdk-vuejs-sample

Thanks in advance,

Paul.

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [July 19, 2022, 4:32pm UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/2 "2022-07-19T16:32:21Z")

</div>

Hi @paul.deehan ,

Which specific SDK and version are you using? Additionally, can you please clarify what SDK credentials you’re using exactly? There’s a few threads on this, and I encourage you to check out some of them, like this one:

> [@Invalid signature using Web SDK](https://devforum.zoom.us/t/invalid-signature-using-web-sdk/46614/2):
>
> Hey @russliu, Thank you for reaching out to the Zoom Developer Forum. It looks like you’re using an SDK key and secret. When it comes to the [Web SDK](https://marketplace.zoom.us/docs/sdk/native-sdks/web#zoom-web-sdk), make sure that you are using a [JWT App](https://marketplace.zoom.us/docs/guides/auth/jwt)’s API Key and Secret. Let me know if that helps. Thanks, Max

Thank you!

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 20, 2022, 9:35am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/3 "2022-07-20T09:35:46Z")

</div>

I’m obtaining an OAUTH token from this API call:

[https://zoom.us/oauth/token?grant\_type=authorization\_code&code=](https://zoom.us/oauth/token?grant_type=authorization_code&code=)" + code + “&redirect\_uri=” + url

I use OAUTH credentials from the App I’ve created

The then create a meeting room via:

[https://api.zoom.us/v2/users/me/meetings?access\_token=](https://api.zoom.us/v2/users/me/meetings?access_token=)" + token (OAUTH token from above).

I then use the “id” field to generate a signature end point. Note if I copy the Zoom URL from the above call it opens a meeting room from the Zoom client I have installed. Obviously I’m after opening in a browser where I can apply my own bespoke styling and branding.

To get the signature end point I use code snippet from original post using the SDK Key and SDK secret.

When I then attempt to enter the room I get invalid signature.

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 20, 2022, 9:36am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/4 "2022-07-20T09:36:57Z")

</div>

It’s suggested I need to use JWT App’s but these are being flagged as deprecated next year?

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 20, 2022, 9:58am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/5 "2022-07-20T09:58:44Z")

</div>

To clarify further I’ve tried this via an OAUTH app, SDK app, JWT app, client Key/Secret combo’s for all three types will generate an OAUTH token will generate a room, will create a signature end point, but ALL 3 get invalid signature. It cannot be this difficult surely?

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 20, 2022, 10:13am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/6 "2022-07-20T10:13:34Z")

</div>

Also as I’m testing this github example ([GitHub - zoom/meetingsdk-vuejs-sample: Use the Zoom Meeting SDK in a Vue.js App](https://github.com/zoom/meetingsdk-vuejs-sample)) it does state to use SDK app credentials

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [July 21, 2022, 10:45am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/7 "2022-07-21T10:45:14Z")

</div>

Update:

STILL NOT WORKING

I’ve added a VUE method to generate signature:

```auto
   getSignature() {
      const timestamp = new Date().getTime() - 30000
      const msg = Buffer.from(this.apiKey + this.meetingNumber + timestamp + this.role).toString('base64')
      const hash = Crypto.createHmac('sha256', this.apiSecret).update(msg).digest('base64')
      const signature = Buffer.from(`${this.apiKey}.${this.meetingNumber}.${timestamp}.${this.role}.${hash}`).toString('base64')
      this.startMeeting(signature)
    },

```

And still getting invalid signature.

I’ve not tried all combinations of API keys and secrets on ALL apps on my test account.

Can anyone assist or should I merely turn attention to Twilio or Vonage.

What email address can I escalate this please?

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [July 27, 2022, 7:35am UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/8 "2022-07-27T07:35:36Z")

</div>

Hi @paul.deehan , you use the SDK app credentials to generate a JWT. This is different from the JWT app _type_ that will be deprecated. I apologize for linking the earlier thread as it is an outdated workflow.

Please follow the process as outlined as followed here: [SDK Authentication](https://marketplace.zoom.us/docs/sdk/native-sdks/auth#sdk-authentication)

Let me know if this is clearer.

---

<div class="post-metadata">

**Author:** ![paul.deehan](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@paul.deehan](https://devforum.zoom.us/u/paul.deehan)\
**Post date:** [September 13, 2022, 2:19pm UTC](https://devforum.zoom.us/t/invalid-signature-help/72496/9 "2022-09-13T14:19:36Z")

</div>

No it is not any clearer - you are sending me to SDK authentication which refers to an end point with a meeting Number.

HOW DO YOU GET A MEETING NUMBER?

I take my apiKey/Secret and get token e.g. [https://zoom.us/oauth/token?grant\_type=client\_credentials](https://zoom.us/oauth/token?grant_type=client_credentials)

I use the token to create meeting e.g.

[https://api.zoom.us/v2/users/me/meetings](https://api.zoom.us/v2/users/me/meetings)

But now all I get is not authorised.

Sorry but the documentation on here is shocking.