# Server to server app authentication issue

**URL:** <https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271>\
**Category:** Authentication\
**Tags:** api\
**Created:** [August 31, 2023, 3:04pm UTC](https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271 "2023-08-31T15:04:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![geoff.crego](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@geoff.crego](https://devforum.zoom.us/u/geoff.crego)\
**Post date:** [August 31, 2023, 3:04pm UTC](https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271/1 "2023-08-31T15:04:37Z")

</div>

**API Endpoint(s) and/or Zoom API Event(s)**  
[https://zoom.us/oauth/token?grant\_type=account\_credentials&account\_id=xxxxxxx](https://zoom.us/oauth/token?grant_type=account_credentials&account_id=xxxxxxx)

**Description**  
Setting up a new Server to server internal app and running into an issue getting the access\_token. I am using PHP on my server and attempting a curl request to the endpoint. I did find where someone else posted about this and have a code example very similar to theirs but I am still getting the following error message.

**Error?**  
{“reason”:“Bad Request”,“error”:“invalid\_request”}

**How To Reproduce**

```
	$endpoint = 'https://zoom.us/oauth/token?grant_type=account_credentials&account_id=' . $int['api_key'];

	$headers[] = "Authorization: Basic " . base64_encode($int['username'] . ":" . $int['password']);
	$headers[] = "Content-Type: application/x-www-form-urlencoded";

	$body = array(
		'grant_type' => 'client_credentials'
	);

	// CURL to GET access_token
	$ch = @curl_init();
	@curl_setopt($ch, CURLOPT_POST, true);
	@curl_setopt($ch, CURLOPT_URL, $endpoint);
	@curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
	@curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
	@curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
	@curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	$response = @curl_exec($ch);
	$status_code = @curl_getinfo($ch, CURLINFO_HTTP_CODE);
	$curl_errors = curl_error($ch);
	@curl_close($ch);

```

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [September 4, 2023, 3:12am UTC](https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271/2 "2023-09-04T03:12:11Z")

</div>

@geoff.crego ,

> $endpoint = ‘[https://zoom.us/oauth/token?grant\_type=account\_credentials&account\_id=](https://zoom.us/oauth/token?grant_type=account_credentials&account_id=)’ . $int[‘api\_key’];

This needs to be account id, not api key

> $headers = "Authorization: Basic " . base64\_encode($int[‘username’] . “:” . $int[‘password’]);

This needs to be appID and appSecret, not username and password

---

<div class="post-metadata">

**Author:** ![geoff.crego](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@geoff.crego](https://devforum.zoom.us/u/geoff.crego)\
**Post date:** [September 6, 2023, 2:28pm UTC](https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271/3 "2023-09-06T14:28:43Z")

</div>

Thanks for the reply. It helped me notice that I had fat fingered one of the parameters in my code. Once I fixed that everything is working as expected.

While you think I am using the wrong values but I am pulling those from a database object where I stored the correct values in those fields.

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [September 7, 2023, 2:25am UTC](https://devforum.zoom.us/t/server-to-server-app-authentication-issue/94271/4 "2023-09-07T02:25:57Z")

</div>

@geoff.crego , glad that I was able to help, indirectly nonetheless 😃