# Randomly receiving "Invalid access token" for Server-to-Server OAuth

**URL:** <https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432>\
**Category:** API and Webhooks\
**Tags:** oauth\
**Created:** [August 17, 2022, 9:24pm UTC](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432 "2022-08-17T21:24:46Z")\
**Posts on this page:** 1\
**Showing post:** 22

<div class="post-metadata">

**Author:** ![david5](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/david5/32/40553_2.png) [@david5](https://devforum.zoom.us/u/david5)\
**Post date:** [September 15, 2022, 2:30pm UTC](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432/22 "2022-09-15T14:30:56Z")

</div>

For posterity and anyone else who happens to run across this thread while scratching their head about how Server-to-Server OAuth works:

1. Requesting a new Server-to-Server OAuth token invalidates the previous one.
2. Zoom can increase the “index” count for your account, allowing you to request different tokens with different indexes that do not interfere with each other (i.e. requesting a token for index 1 doesn’t invalidate the token requested for index 2).
3. The token index is specified in the call to [https://zoom.us/oauth/token](https://zoom.us/oauth/token) by passing the `token_index` query parameter ([https://zoom.us/oauth/token?token\_index=2](https://zoom.us/oauth/token?token_index=2))

This should allow folks to build out a background oauth token rotation strategy where the token is updated in a central place, using a new index value (e.g. database, AWS SSM or secrets manager, etc.) allowing applications to continue using the previous token until they can read the new value from the central location.

---

_[View the full topic](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432)._