# {"reason":"Invalid authorization code \*\*\*","error":"invalid\_grant"}

**URL:** <https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541>\
**Category:** API and Webhooks\
**Created:** [February 22, 2023, 5:52am UTC](https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541 "2023-02-22T05:52:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thaicao](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/thaicao/32/44091_2.png) [@thaicao](https://devforum.zoom.us/u/thaicao)\
**Post date:** [February 22, 2023, 5:52am UTC](https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541/1 "2023-02-22T05:52:28Z")

</div>

Hello I am currently getting the error:  
{“reason”:“Invalid authorization code [REDACTED]”,“error”:“invalid\_grant”}

I used the zoomapp sdk and used the authorize and onauthorized functions on the client side to get the authorization code  
{code: “_ **", result: true, timestamp: 1677044707, redirectUri: "https://** _.ngrok.io/”}

Then I send the code to the backend with a code\_verifier to then the server sends a post to  
“[https://zoom.us/oauth/token](https://zoom.us/oauth/token)” with the parameters

?grant\_type=authorization\_code&code=_ **&code\_verifier=** _&redirect\_uri=\*\*\*

No Luck ☹  
Can someone please help with this Ive been stuck on why its giving authorization code error the last two days

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [February 22, 2023, 5:03pm UTC](https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541/2 "2023-02-22T17:03:50Z")

</div>

@thaicao,

Thanks for posting in the Zoom Developer Forum. Can you share if the code\_challenge\_method `plain` or not?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/9/d/9dac18951415d48c34305e01d71d772bd2c1960e.png)

Resource :

# Authentication

[https://marketplace.zoom.us/docs/zoom-apps/guides/authentication](https://marketplace.zoom.us/docs/zoom-apps/guides/authentication)

---

<div class="post-metadata">

**Author:** ![thaicao](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/thaicao/32/44091_2.png) [@thaicao](https://devforum.zoom.us/u/thaicao)\
**Post date:** [February 28, 2023, 12:42am UTC](https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541/3 "2023-02-28T00:42:43Z")

</div>

Here is my codeChallenge generator:  
async function generateCodeChallenge() {  
// Generate a random string for the challenge  
const challenge = await generateRandomString(64);

```
        // Convert the challenge to a buffer
        const challengeBuffer = new TextEncoder().encode(challenge);
        
        // Encode the buffer using plain encoding
        const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(challengeBuffer)));
        
        // Generate a random string for the verifier
        const verifier = await generateRandomString(64);
        
        // Convert the verifier to a buffer
        const verifierBuffer = new TextEncoder().encode(verifier);
        
        // Encode the buffer using base64
        const codeVerifier = btoa(String.fromCharCode(...new Uint8Array(verifierBuffer)));
        
        return { codeChallenge, codeVerifier };
      }

```

I am also using zoom app sdk onauthorize to generate the authorization token

async function generateRandomString(length) {  
const randomBytes = new Uint8Array(length);  
await window.crypto.getRandomValues(randomBytes);  
return btoa(String.fromCharCode(…randomBytes)).substring(0, length);  
}

I tried almost everything here is what i’m getting:  
{“reason”:"Invalid authorization code \*\*\*,“error”:“invalid\_grant”}

router.get(‘/zoomcallback’, function(req, res) {

const zoomtokenep = “[https://zoom.us/oauth/token](https://zoom.us/oauth/token)”;  
sanitize(req)  
const myappredirect = req.query.redirectUri;  
console.log(“zoomcallback”)  
if (req.query.code) {  
console.log(“CODE VERIFIER”)  
console.log(req.query.code\_verifier)  
console.log(req.query.code)  
const zoomclientid = “Z\*\*\*”  
const zoomclientsec = “T\*\*\*”  
const auth = ‘Basic ’ + Buffer.from(zoomclientid + ‘:’ + zoomclientsec).toString(‘base64’);  
console.log(auth)  
var url = zoomtokenep + ‘?grant\_type=authorization\_code&code=’ +  
req.query.code + ‘&code\_verifier=’+req.query.code\_verifier +’&redirect\_uri=’ + myappredirect;  
request.post({  
url: url,  
headers: {  
“Content-Type”:“application/x-www-form-urlencoded”,  
“Authorization”: auth  
}  
}, function(error, response, body) {  
console.log(response)  
if (error) {  
console.log("Error when getting Zoom token = " + error);  
return;  
}  
body = JSON.parse(body);  
if (body.access\_token) {  
accessToken = body.access\_token;  
// Process and securely store these tokens  
res.send({ output: accessToken});  
} else {  
console.log(“FATAL - could not get zoom token”);  
}  
return;  
});

} else {  
console.log(“Missing code from Zoom”);  
}  
});

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [March 2, 2024, 4:18pm UTC](https://devforum.zoom.us/t/reason-invalid-authorization-code-error-invalid-grant/83541/4 "2024-03-02T16:18:57Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.