# Request From Website Instead Of Postman Returns "invalid authorization code" response

**URL:** <https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495>\
**Category:** API and Webhooks\
**Tags:** webinar, oauth\
**Created:** [October 17, 2022, 1:06pm UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495 "2022-10-17T13:06:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![digital-medium](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/digital-medium/32/40359_2.png) [@digital-medium](https://devforum.zoom.us/u/digital-medium)\
**Post date:** [October 17, 2022, 1:06pm UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/1 "2022-10-17T13:06:01Z")

</div>

Hi,

I’m trying to move an API request that I have working on Postman to a PHP/WordPress website. To help with this I referred to this previous discussion regarding how to get an oAuth access token through CURL [Need help on how to programatically get Access Token [PHP]](https://devforum.zoom.us/t/need-help-on-how-to-programatically-get-access-token-php/46516)

From this, I then made the following (with tokens changed)

```auto
 $curl = curl_init();
  curl_setopt_array($curl, array(
  CURLOPT_URL => "https://zoom.us/oauth/token?grant_type=authorization_code&code=[REDACTED]&redirect_uri=https://oauth.pstmn.io/v1/callback&client_id=[REDACTED]",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => array(
    "Authorization: Basic [REDACTED]",
   "Content-Type: application/x-www-form-urlencoded"
  ),
));

 $response = curl_exec($curl);
 //echo $response;
 //$access_token = $response['access_token'];
 error_log($response);
 curl_close($curl);

```

However, whereas on Postman, I was getting a successful response with an access token, when making the request using this code above, I now get:

`{"reason":"Invalid authorization code","error":"invalid_grant"}`

I have checked the console on Postman and it appears that the Base64 Encoded string for the authorization is the same so is there any other reason why my request to get the access token would fail?

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [October 17, 2022, 4:11pm UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/2 "2022-10-17T16:11:31Z")

</div>

@digital-medium,

Thank you for posting in the Zoom Developer Forum. Have you verified that you are sending all the appropriate headers for the curl request?

---

<div class="post-metadata">

**Author:** ![digital-medium](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/digital-medium/32/40359_2.png) [@digital-medium](https://devforum.zoom.us/u/digital-medium)\
**Post date:** [October 17, 2022, 4:56pm UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/4 "2022-10-17T16:56:37Z")

</div>

Hi @donte.zoom

Thanks for getting back to me.

I had a look at this example from the Zoom documentation

```auto
# Header
Host: zoom.us
Authorization: Basic Q2xpZW50X0lEOkNsaWVudF9TZWNyZXQ=
Content-Type: application/x-www-form-urlencoded

# Request body
code: [CODE]
grant_type: authorization_code
redirect_uri: [REDIRECT URI]
code_verifier: [CODE VERIFIER]

```

The only header I seemed to be missing was the Host header so I updated my code above to now say

```auto
  CURLOPT_HTTPHEADER => array(
    "Authorization: Basic [REDACTED]",
   "Content-Type: application/x-www-form-urlencoded",
   "Host: zoom.us"
  ),

```

However, this still didn’t work.

These were then the headers that Postman was sending across

```auto
Content-Type: application/x-www-form-urlencoded
Authorization: Basic [Redacted]
User-Agent: PostmanRuntime/7.29.2
Accept: */*
Cache-Control: no-cache
Postman-Token: e6d6841d-5e8d-4bf0-8031-805ec9f3a10a
Host: zoom.us
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 159
Cookie: _zm_mtk_guid=b2b61d9a73cd46e4be55f0594cb373b6; _zm_visitor_guid=b2b61d9a73cd46e4be55f0594cb373b6

```

Would any of these other headers make a difference?

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [October 18, 2022, 12:25am UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/5 "2022-10-18T00:25:09Z")

</div>

@digital-medium ,

The request looks good – although it looks like the value for the Authorization header seems off. To troubleshoot the Invalid authorization code error, can you try to make a request to the auth endpoint :

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/d/6/d662713e704f75ea2588c39dccb7f78fb23a1e74.png)

Then use the code value returned in your PHP request to the token endpoint?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/3/a/3a4b7f2a3f670a48ea4b00bb2608c0ea2b0b2979.png)

Also, can you confirm what app type are you using and how are you configuring your Marketplace app credentials in Postman as well?

---

<div class="post-metadata">

**Author:** ![digital-medium](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/digital-medium/32/40359_2.png) [@digital-medium](https://devforum.zoom.us/u/digital-medium)\
**Post date:** [October 18, 2022, 10:15am UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/6 "2022-10-18T10:15:06Z")

</div>

Hi Dante,

Thanks I have now solved this. I thought the authorization code you got from step 1 could be reused to get multiple access tokens but I understand that’s not the case.

I have sorted this now. Thanks for your assistance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [October 22, 2023, 1:51am UTC](https://devforum.zoom.us/t/request-from-website-instead-of-postman-returns-invalid-authorization-code-response/77495/7 "2023-10-22T01:51:22Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.