# JWT Access token signature verification

**URL:** <https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146>\
**Category:** Authentication\
**Tags:** jwt\
**Created:** [June 18, 2025, 11:34am UTC](https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146 "2025-06-18T11:34:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ferenc](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ferenc/32/49985_2.png) [@Ferenc](https://devforum.zoom.us/u/Ferenc)\
**Post date:** [June 18, 2025, 11:34am UTC](https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146/1 "2025-06-18T11:34:39Z")

</div>

**API Endpoint(s) and/or Zoom API Event(s)**  
[https://zoom.us/oauth/token](https://zoom.us/oauth/token)

**Description**  
Unable to verify JWT signature with app Client Secret

**Error?**  
Signature verification failed

**How To Reproduce**  
_1. Create a Zoom app_  
_2. After authorizing the app, get an access token from [https://zoom.us/oauth/token](https://zoom.us/oauth/token) with the authorization code_  
_2. Verify the signature of the received token with the app Client Secret_  
_3. Signature verification fails_

Notes:  
The Client Secret is 32 bytes long  
The access tokens are signed with the HS512 algorithm  
The keys of the HS512 algorithm are 64 bytes long  
Are the keys derived from the Client Secret? How should we verify the signature of an access token?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![expertswho](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/expertswho/32/60945_2.png) [@expertswho](https://devforum.zoom.us/u/expertswho)\
**Post date:** [June 21, 2025, 3:23pm UTC](https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146/2 "2025-06-21T15:23:16Z")

</div>

hi @Ferenc  
welcome to the community.  
Check out some of the youtube videos, there was a series last september that coverred this, an example is this

[![](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/b/6b8a467edfca7729d5f25e20c55ca1cdf8d172b7.jpeg "Joining Zoom Meeting SDKs: Encoding JWT") ](https://www.youtube.com/watch?v=SjlnjL0afKI)

all the best

John

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [June 27, 2025, 1:39pm UTC](https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146/3 "2025-06-27T13:39:30Z")

</div>

Hi @Ferenc  
Can you please share with us what signature you are talking about that you are trying to verify?

---

<div class="post-metadata">

**Author:** ![Ferenc](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ferenc/32/49985_2.png) [@Ferenc](https://devforum.zoom.us/u/Ferenc)\
**Post date:** [June 27, 2025, 2:18pm UTC](https://devforum.zoom.us/t/jwt-access-token-signature-verification/134146/4 "2025-06-27T14:18:14Z")

</div>

Disclaimer: I don’t need to validate the tokens anymore, since I found another way for solving my problem, I don’t use JWT tokens from Zoom anymore.

But for future reference, I’ll try to explain:

It’s not unusual to use a signed JWT (for example, an ID token) to attribute a 3rd party user (identified by the ID token) in an internal system. For example, the signature of ID tokens signed by Microsoft can be verified via their public OpenID configuration document (see Microsoft docs on `OpenID Connect on the Microsoft identity platform`)

After validating the token signature, `sub` or any other property of the token could be used for user attribution. I don’t think I have to explain why validation is crucial when processing third party tokens in this manner.

I do understand that these tokens are usually used on Zoom APIs, where they are validated by Zoom itself, which is perfectly fine. But it would be great if we could tell that a JWT was signed by Zoom or not.