# Issues with OAuth state

**URL:** <https://devforum.zoom.us/t/issues-with-oauth-state/137610>\
**Category:** Authentication\
**Created:** [September 23, 2025, 6:18pm UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610 "2025-09-23T18:18:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbolton](https://avatars.discourse-cdn.com/v4/letter/m/7ea924/32.png) [@mbolton](https://devforum.zoom.us/u/mbolton)\
**Post date:** [September 23, 2025, 6:18pm UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610/1 "2025-09-23T18:18:57Z")

</div>

### 

**API Endpoint(s) and/or Zoom API Event(s)**  
OAuth callback url.

**Description**

We use an object as our `state` param for the OAuth url.

```json
{
 "x": "value",
 "y": "value"
}

```

Recently we have noticed that after authorizing the app on Zoom, the state is returned to us with different encoding.

Previously we would receive

`code=CODE&state=%7B%22x%22%3A+%22value%22%2C+%22y%22%3A+%22value%22%7D`

And now we receive it with these `quot` in the query params.

`code=CODE&state=%7B%26quot%3Bx%26quot%3B%3A%20%26quot%3Bvalue%26quot%3B%2C%20%26quot%3By%26quot%3B%3A%20%26quot%3Bvalue%26quot%3B%7D`

**Error?**  
Our code is expecting the query params to be returned in a consistent format so that we can appropriately parse them.

**How To Reproduce**  
_Steps to reproduce the behavior:_

1. Call the OAuth url with a state param that is an object `https://zoom.us/oauth/authorize?response_type=code&client_id=ZOOM_CLIENT_ID&redirect_uri=ZOOM_REDIRECT_URI&state=%7B%22x%22%3A+%22value%22%2C+%22y%22%3A+%22value%22%7D`
2. Inspect the response that comes back after authorizing.
3. Note the `quot` in the encoded query params.

---

<div class="post-metadata">

**Author:** ![Canny\_Engineering](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Canny\_Engineering](https://devforum.zoom.us/u/Canny_Engineering)\
**Post date:** [September 24, 2025, 3:16am UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610/2 "2025-09-24T03:16:39Z")

</div>

We’ve noticed this change as well, and it has broken our installation flow. Could the Zoom team clarify whether this was introduced unintentionally as a bug, or if it’s an intentional change we should plan around going forward?

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [September 24, 2025, 7:13pm UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610/4 "2025-09-24T19:13:01Z")

</div>

Looking into this @mbolton . Sending you a private message to also get your production client id. Check your notifications.

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [September 25, 2025, 3:24pm UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610/5 "2025-09-25T15:24:03Z")

</div>

Hi @mbolton @Canny_Engineering , we’ve discovered this was a breaking change impacting certain customers and have rolled out the fix (ZOOM-1044988). Can you please try again?

---

<div class="post-metadata">

**Author:** ![Canny\_Engineering](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Canny\_Engineering](https://devforum.zoom.us/u/Canny_Engineering)\
**Post date:** [September 25, 2025, 4:07pm UTC](https://devforum.zoom.us/t/issues-with-oauth-state/137610/6 "2025-09-25T16:07:38Z")

</div>

Thanks for the quick fix! Looks good on my end.