# OAuth 403 error in Development environment for General App

**URL:** <https://devforum.zoom.us/t/oauth-403-error-in-development-environment-for-general-app/131969>\
**Category:** Authentication\
**Created:** [April 26, 2025, 3:19am UTC](https://devforum.zoom.us/t/oauth-403-error-in-development-environment-for-general-app/131969 "2025-04-26T03:19:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidgarthe](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/davidgarthe/32/68517_2.png) [@davidgarthe](https://devforum.zoom.us/u/davidgarthe)\
**Post date:** [April 26, 2025, 3:19am UTC](https://devforum.zoom.us/t/oauth-403-error-in-development-environment-for-general-app/131969/1 "2025-04-26T03:19:20Z")

</div>

**API Endpoint(s) and/or Zoom API Event(s)**  
([Error - Zoom](https://zoom.us/oauth/authorize))

**Description**

I am building my first Zoom app, and it’s within the Zoom client. It’s written in VUE JS, and I selected “General App” when creating it within the Zoom Marketplace.

I am simply trying to redirect to the Oauth approval screen for the user, but keep getting a 403 error in the Dev Console saying the domain and/or scheme is not allowed.

Sending to this link (vars have been changed)  
**[https://zoom.us/oauth/authorize?response\_type=code&client\_id=123456&redirect\_uri=https://xyz.com](https://zoom.us/oauth/authorize?response_type=code&client_id=123456&redirect_uri=https://xyz.com)**

I have my URL ([https://xyz.com](https://xyz.com/)) setup as the Oauth redirect value in my Marketplace listing.

It works fine OUTSIDE of the Zoom client as a test, but not within the Zoom client.

Any help would be MUCH appreciated. Thank you!

**Error?**  
In the Dev console -  
VM26:1 zoom 403 Forbidden, domain or scheme is not allowed:  
[https://zoom.us/oauth/authorize?response\_type=code&client\_id=123456&redirect\_uri=https%3A%2F%2Fxyz.com](https://zoom.us/oauth/authorize?response_type=code&client_id=123456&redirect_uri=https%3A%2F%2Fxyz.com)

**How To Reproduce**  
_Steps to reproduce the behavior:_  
\*1. Request URL / Headers

HTTP/1.1 200 OK  
Content-Type: text/html  
Content-Length: 336  
Connection: keep-alive  
Date: Sat, 26 Apr 2025 03:16:58 GMT  
Server: AmazonS3  
Accept-Ranges: bytes  
ETag: “4a87a73e7d2331af889bf60f2279b244”  
Last-Modified: Fri, 25 Apr 2025 21:40:49 GMT  
Cache-Control: public, max-age=0, s-maxage=31536000  
strict-transport-security: max-age=31536000; includeSubDomains  
x-content-type-options: nosniff  
content-security-policy: script-src ‘self’ https: ‘unsafe-inline’ [https://source.zoom.us](https://source.zoom.us) [https://appssdk.zoom.us](https://appssdk.zoom.us) [https://zoom.us](https://zoom.us) [https://xyz.com](https://xyz.com)  
referrer-policy: origin  
X-Cache: Miss from cloudfront  
Via: 1.1 [43fdc10c34c2e19fe9ecc909cc348782.cloudfront.net](http://43fdc10c34c2e19fe9ecc909cc348782.cloudfront.net) (CloudFront)  
X-Amz-Cf-Pop: ORD56-P3  
Alt-Svc: h3=“:443”; ma=86400  
X-Amz-Cf-Id: -HIpWKBo9USjiLKSj9AjMNvWmbGix7vrdS8AduZWhy7AdMAi6holQg==

_2. Authentication method or app type_  
Redirect to URL using “window.location.href” command on button click event.

---

<div class="post-metadata">

**Author:** ![davidgarthe](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/davidgarthe/32/68517_2.png) [@davidgarthe](https://devforum.zoom.us/u/davidgarthe)\
**Post date:** [April 28, 2025, 12:55pm UTC](https://devforum.zoom.us/t/oauth-403-error-in-development-environment-for-general-app/131969/2 "2025-04-28T12:55:03Z")

</div>

If anyone has any ideas, you will be my BFF for life.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [May 2, 2026, 4:31am UTC](https://devforum.zoom.us/t/oauth-403-error-in-development-environment-for-general-app/131969/3 "2026-05-02T04:31:58Z")

</div>

Closed on May 2, 2026, 4:31am UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.