# Server to Server get/users endpoint returns 124 Invalid Access Token **URL:** \ **Category:** Authentication\ **Created:** [November 29, 2022, 10:07pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476 "2022-11-29T22:07:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![conor.mccarthy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/conor.mccarthy/32/44322_2.png) [@conor.mccarthy](https://devforum.zoom.us/u/conor.mccarthy)\ **Post date:** [November 29, 2022, 10:07pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/1 "2022-11-29T22:07:30Z")
**API Endpoint(s) and/or Zoom API Event(s)** GET users/ **Description** I am trying to use server-to-server oauth to access details of a user by calling the GET users endpoint. I can obtain the server-to-server access token successfully. I have given my Server-to-Server app the scope /user:read:admin When I examine the scope returned along with the access token, this scope is definitely present. Every attempt to call the GET users endpoint results in the error 401 124 Invalid Access token I have seen that others have a similar issue intermittently where multiple processes are obtaining access tokens. This is not the case for me - I have only one process. It has never worked. **Error?** ```auto HTTP/1.1 401 Unauthorized Date: Tue, 29 Nov 2022 21:51:51 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive x-zm-trackingid: v=2.0;clid=aw1;rid=WEB_a5498820a56b632b9de14b5811051802 x-content-type-options: nosniff Cache-Control: no-cache, no-store, must-revalidate, no-transform pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: zm_aid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly x-zm-zoneid: VA2 content-disposition: inline;filename=f.txt set-cookie: zm_haid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: zm_tmaid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: zm_htmaid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: cred=FC490C795A208B660124EA59A1D5C191; Path=/; Secure; HttpOnly CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MFI1byhKhlLqsRf7aZtGaIXFGJyu5rcD%2B3ZJ%2FH%2FYRrpFIqzmToJ0%2FKnFj2tbrFN0t48XVukq2qy5WJ0en%2FGBwbnauDEfLH7ekWYxFQKLuYpV%2BcqFYMOzPRflNW4T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 771e91292ebbdc31-LHR {"code":124,"message":"Invalid access token."} ``` **How To Reproduce** 1. Call token endpoint with account\_credentials grant type: ```auto https://zoom.us/oauth/token?grant_type=account_credentials?account_id=XXXXXXX ``` 1. Call users endpoint, including the returned access token from step 1 ```auto GET /V2/users/ ***REDACTED*** HTTP/1.1 Authorization: Bearer ***REDACTED*** User-Agent: PostmanRuntime/7.29.2 Accept: */* Postman-Token: 90622bc1-58c5-4d23-a9d3-1a677d6ab51b Host: api.zoom.us Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: TS018dd1ba=01213d1771ef96e4f21372e35ef95abc46d82a514d810fd007bf69a1bccab91b781388b288abf4faeb3e5abc86e03bfc46d3eeabe3; __cf_bm=_6.9O_ZXYvicx.JUSB9R21asdQx9Tl0f5e9165nHKKE-1669758589-0-Aff6rlCTjTwthasuyf7HXNWXF1TzuwzpF6l4PmNzCOLPOch6Sej7WLy+adjmLI2zuB+stzAmnvaT3QeaNp+ecis=; _zm_chtaid=558; _zm_ctaid=4xDdJUL_TpqByddKn9FhWw.1669757691477.a062f0405fbcf951658ef9a245940aeb; _zm_mtk_guid=2fa9f28edc0840eca371276ee415227d; _zm_page_auth=aw1_c_xPb0OcUMT9SnPcAqzZdjlg; _zm_ssid=aw1_c_4z8JO2t_SIKwWF8OMoUOxw; cred=F0FDF47D82169A3D1604971800801EB0 HTTP/1.1 401 Unauthorized Date: Tue, 29 Nov 2022 21:50:16 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive x-zm-trackingid: v=2.0;clid=aw1;rid=WEB_cac2e97dc09b69bb07f6707179d8b045 x-content-type-options: nosniff Cache-Control: no-cache, no-store, must-revalidate, no-transform pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: zm_aid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: zm_haid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: zm_tmaid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: zm_htmaid=""; Domain=.zoom.us; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly set-cookie: cred=45888120A662C36CBE347CAA0CE95FD1; Path=/; Secure; HttpOnly x-zm-zoneid: VA2 content-disposition: inline;filename=f.txt CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQOSSAXDpJYgKfqP2xx4XWM2%2F2M88OY33wSpcK5A%2BZ2yPXxB9GiUAYwrS67VEzYfkPjRj%2FUmirA8CYB7IX92VXSuRDgNRDsIeGMVwcXLLTWuXQ6bNdN2b9AA%2FIjj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 771e8ed80ef0dc31-LHR {"code":124,"message":"Invalid access token."} ``` Authentication method or app type\*: Authentication method is OAuth Server to Server. I am using PostMan to test. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 29, 2022, 11:42pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/2 "2022-11-29T23:42:59Z")
Hi @conor.mccarthy Thanks for reaching out to the Zoom Developer Forum and welcome to our community! Can you please confirm if you are getting the token with the appropriate scopes to access the Get Users endpoint? If you are calling the Get users endpoint, make sure that your Server to Server OAuth apps, has the scope user:read:admin enabled. Here is a post that I created a couple of months ago on how to use our Server to Server OAuth app with Postman: > [@How to user Server-to-Sever OAuth app with Postman](https://devforum.zoom.us/t/how-to-user-server-to-sever-oauth-app-with-postman/70848): > > How to use our Server-to-Server OAuth with Postman? As some of you might be aware of, our JWT app is being deprecated by June 2023 and we encourage you to migrate to the newly introduced [Server-to-Server OAuth App](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app) That being said, here is a quick and simple guide on how to use or new app with Postman As stated in our documentation here: This new app type facilitates OAuth-authenticated requests between servers without end-user involvement. And this grant type enable your private server a… Let me know if this helps, Elisa ---
**Author:** ![conor.mccarthy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/conor.mccarthy/32/44322_2.png) [@conor.mccarthy](https://devforum.zoom.us/u/conor.mccarthy)\ **Post date:** [November 30, 2022, 7:49am UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/3 "2022-11-30T07:49:56Z")
Hi, Thanks for your reply. As I said in the message, I have checked the scope property returned with the access token, and it has the user:read:admin scope. My app has that scope enabled. The article you linked is the one that I have followed. So I still need some help with this. thank you Conor ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [November 30, 2022, 3:19pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/4 "2022-11-30T15:19:19Z")
@conor.mccarthy Thanks for the clarification. I will send you a private message to follow up with more details. Best, Elisa ---
**Author:** ![mthompson](https://avatars.discourse-cdn.com/v4/letter/m/a4c791/32.png) [@mthompson](https://devforum.zoom.us/u/mthompson)\ **Post date:** [December 9, 2022, 4:48pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/5 "2022-12-09T16:48:09Z")
Hi, Was a solution found for this? I’m having the same issue Cheers Matt ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [December 9, 2022, 7:53pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/6 "2022-12-09T19:53:30Z")
Hi @mthompson Thanks for reaching out and welcome to our community! I am glad you ask! I totally forgot to share the solution for this. After some debugging, we found that it was basically a typo in the base URL This is our base URL: “[https://api.zoom.us/v2](https://api.zoom.us/v2)” the calls were made with “[https://api.zoom.us/V2](https://api.zoom.us/V2)” The capital V was not allowing us to get data back. Hope this helps, Elisa ---
**Author:** ![conor.mccarthy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/conor.mccarthy/32/44322_2.png) [@conor.mccarthy](https://devforum.zoom.us/u/conor.mccarthy)\ **Post date:** [December 11, 2022, 3:08pm UTC](https://devforum.zoom.us/t/server-to-server-get-users-endpoint-returns-124-invalid-access-token/79476/7 "2022-12-11T15:08:51Z")
@elisa.zoom Thanks for this - we did have one other instance of this problem in our solution which was preventing us from accessing the API. I’m marking your reply as the solution.