"Invalid Token!" error message when trying to refresh oauth token

API and Webhooks
62

Hi @tommy,

We are calling this endpoint when we receive a participant joined callback and the participant’s access token is expired: https://zoom.us/oauth/token?grant_type=refresh_token&refresh_token={insertTokenHere}

For only 2 of our users (out of hundreds of users), something seems to have gone wrong in the refresh process.

The users requested refresh as usual, and logs show that the refresh went through fine, and the token was stored. Looking at the refresh token also shows that its “exp” and “nbf” are reasonable. Furthermore, the users do not seem to have ever deauthorized our app.

I think the only way forward for these two users will be to contact them and ask them to re-install (correct me if I’m wrong).

My main concern, however, is that this happen to other users as well, which is why I’d like your help to determine the cause.

Thanks

63

@KGEM Direct messaged for details.

64

Hi, I am developing an app when the user can’t reauthorize every time but it seems that my refresh token is always invalid when I try to get a new access token. I have tested the client id and it is valid. I have tried it for the past few days but it never seems to work. What is the solution?

2 Likes
65

Hey @kresna.jenie,

Please provide steps to reproduce the issue so we can help. :slight_smile:

Thanks,
Tommy

66

Same exact problem. I get the token and refresh. Tested my refresh functionality, and it seems to work the first time. Wait later, and run it again and get Invalid Token! message.

1 Like
67

Hi Tommy,
In the Zoom production environment, how many days of access token will be alive without expired ?
I mean 15 days or 1 month like that.

Thank you.

69

@tommy
This is what is happenig to me also
Could you help me with this issue?
What fix it for @neecholai maybe is my same problem
Thank you!

70

@tommy
Hi we’re seeing the same issue. We’re using a POST request and saving our latest refresh token every time we obtain a new access token. Would you be able to help me out? Thanks!

1 Like
71

@tommy We’re having a very similar issue. It seems like the Refresh Token is never any good. Here’s our scenario.

Do Auth to get an Access Token and a Refresh Token for user-level app and save to our database.
Then either wait more than one hour or corrupt the AT in our DB so we no longer our a valid AT.
Make a call to try to book a meeting using the AT, we get a 401 error. (expected.)
Make a call to refresh the tokens passing the RT. We get a 401 error saying the token is invalid. (not expected and has worked in the past.)

2 Likes
74

Hey @kkoellner, @ryanau, @pablo.fredes, @brettstubbs,

Are you still seeing this issue? Please try reauthorizing your OAuth app to reset the token flow.

One common reason this can happen is if a user Zoom OAuths with your app on a different device. If that happens, the original set of OAuth tokens will no longer be valid since Zoom only supports one valid refresh and access token at a time for a user.

Thanks,
Tommy

75

Hey @jagadeesh.devula,

The access token lasts for one hour. The latest refresh token lasts for 15 years.

Thanks,
Tommy

76

Yes @tommy still getting a error:
Client error: POST https://zoom.us/oauth/token resulted in a 401 Unauthorized response: {“reason”:“Invalid Token!”,“error”:“invalid_request”}

Im using this app in my local machine and not using different devices…

77

@tommy
I can register with the first auth token but the refresh token is always invalid.
The webinar ID is 91308815810. Is it some configuration error on the Oauth app?

78

Hey @pablo.fredes,

Can you please provide steps to reproduce the issue? Due note, that you need to use the latest refresh token after each refresh request.

Thanks,
Tommy

79

Yes @tommy, here is what I got,
I’m working with a Licensed account to manage Webinars.
So I have a test Webinar created and the idea is to make a form for Registrant Webinars.
I created a Oauth App in: marketplace.zoom.us.
In my local machine I Login to zoom with my Licensed account and everything works well registering user with a form created,
where I always use the access_token unless the response gives me a 401 error,
if that happens I try to request the “Refreshing an Access Token” like is documented, and that is where I’m stuck, is always given me the “Invalid Token” error.
For the “Refreshing an Access Token” request

  $response = $clientr->request('POST', '/oauth/token', [
    "headers" => [
      "Authorization" => "Basic " . base64_encode(CLIENT_ID . ':' . CLIENT_SECRET),
    ],
    'form_params' => [
      "grant_type" => "refresh_token",
      "refresh_token" => $refresh_token,
    ],
  ]);

where $refresh_token is the refresh token that I received when I got logged with the Licensed account the first time.

1 Like
80

Hey @pablo.fredes,

Please try the OAuth and refresh flow in Postman and see if it works. It could very well be a misconfiguration in your code.

Thanks,
Tommy

81

Hey @tommy!
You were right!
There was an error on my sql code, it was not updating correctly the refresh token in my DB.
Thanks for the support!!

1 Like
82

Hey @pablo.fredes,

Happy to hear you figured out the issue! Let me know if you need anything else! :slight_smile:

Thanks,
Tommy

83

Hope this helps someone, basically the problem is the refreshtoken is updated everytime a new access token is called. So you need to update both on your end. Access Token AND refresh token. Otherwise you will get refresh token invalid if you use the original refresh token.

84

Hey @greminders,

Thanks so much for jumping in and helping out—great context for our developers!

Best,
Will