# Server-to-server OAuth: 400 response on token generation **URL:** \ **Category:** API and Webhooks\ **Tags:** oauth, api-requests, api, zoom-room\ **Created:** [October 11, 2022, 5:34pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267 "2022-10-11T17:34:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![maksym.rossiitsev](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@maksym.rossiitsev](https://devforum.zoom.us/u/maksym.rossiitsev)\ **Post date:** [October 11, 2022, 5:34pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/1 "2022-10-11T17:34:26Z")
I have created a Server-to-server app, selected scopes and activated it. However, requesting _[https://zoom.us/oauth/token?grant\_type=account\_credentials&account\_id={accountId}](https://zoom.us/oauth/token?grant_type=account_credentials&account_id=%7BaccountId%7D)_ ends up with 400 error without any further information. Authorization header: tried curl and postman, used postman’s basic auth feature as well as generating token manually (base64 encoded clientId:clientSecret) with a different charsets - same. I’ve tried to re-activate an application, regenerate the client secret, but nothing seems to work. Is there anything I should check in order to fix the problem? Could it be that there are no permissions to use the Server-to-server but somehow I’ve managed to create an app and generate credentials? ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/e/0/e00776880796051de4dc204280081f7f29cad2f5.png) Thank you! ---
**Author:** ![brandon.abajelo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brandon.abajelo/32/39183_2.png) [@brandon.abajelo](https://devforum.zoom.us/u/brandon.abajelo)\ **Post date:** [October 11, 2022, 8:32pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/2 "2022-10-11T20:32:01Z")
@maksym.rossiitsev can you share the exact request you’re making to generate the token manually? If you’ve confirmed the app is created and **activated** in our marketplace, it’s likely some syntax error in the request. ---
**Author:** ![maksym.rossiitsev](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@maksym.rossiitsev](https://devforum.zoom.us/u/maksym.rossiitsev)\ **Post date:** [October 11, 2022, 9:47pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/3 "2022-10-11T21:47:48Z")
Sure, I’m using it the way described here: [Create a Server-to-Server OAuth app](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/) Which is ```auto curl -X POST -H 'Authorization: Basic Base64Encoder(clientId:clientSecret)' https://zoom.us/oauth/token?grant_type=account_credentials&account_id={accountId} ``` ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/7/6/762520ac0ef4ed1b9fb7faff27ee0d13cb321653.png) Not sure what is it exactly that I’m missing… (obscured the basic token and accountId for safety reasons). Interestingly, if I’m using an incorrect token - I do receive a different error ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/9/f/9f1ebe97bff34a545582122c66577b0cbd72d151.png) Thank you, Any piece of advice is appreciated! 🙂 ---
**Author:** ![brandon.abajelo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brandon.abajelo/32/39183_2.png) [@brandon.abajelo](https://devforum.zoom.us/u/brandon.abajelo)\ **Post date:** [October 11, 2022, 10:30pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/4 "2022-10-11T22:30:09Z")
@maksym.rossiitsev I think the encoding might the issue. Our example in the docs is more-so pseudocode rather than exact syntax. If you were to test out encoding on a site like this: [https://www.base64encode.org/](https://www.base64encode.org/) → entering your **clientId:clientSecret** → retrieve the **encoded value** , and then paste that to your curl command like: curl -X POST -H ‘Authorization: Basic **\** ’ -d ‘grant\_type=account\_credentials&account\_id= **\** ’ “[https://zoom.us/oauth/token](https://zoom.us/oauth/token)” It should work. Let me know if that works out for you! ---
**Author:** ![maksym.rossiitsev](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@maksym.rossiitsev](https://devforum.zoom.us/u/maksym.rossiitsev)\ **Post date:** [October 11, 2022, 11:11pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/5 "2022-10-11T23:11:04Z")
Yes, this website is exactly the one I’ve been using for encoding the token… Tried the option you have provided, but still no luck. And as I mentioned - it does acknowledge that I’m using wrong clientSecret when I do, but for some reason, whenever I’m using the correct one - it’s “Bad request” for me (even through the postman, with its Basic authentication method - it does encode it itself). Is there anything service-activation related, that might be the reason of such behavior? I have created an Oauth app today, so I was wondering it might require a little time to get up and running (had something similar with MS services), guess there shouldn’t be anything similar in Zoom, right? Thank you 🙂 ---
**Author:** ![brandon.abajelo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brandon.abajelo/32/39183_2.png) [@brandon.abajelo](https://devforum.zoom.us/u/brandon.abajelo)\ **Post date:** [October 11, 2022, 11:31pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/6 "2022-10-11T23:31:10Z")
@maksym.rossiitsev in the zoom app marketplace, did you create an OAuth app or Server-to-Server OAuth app? In this case we’d want to ensure you created a Server-to-Server app. Secondly, I have seen the case where someone creates an app in the marketplace, selects their scopes, gathers their credentials, but forgets to actually activate. Can you confirm that the Server-to-Server app is indeed activated? You should be able to see this in the **Activation** sidebar menu item of the app. But yes once the app is activated, it _should_ work immediately. I don’t think there’s much of a latency at all before you can start using it. ---
**Author:** ![maksym.rossiitsev](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@maksym.rossiitsev](https://devforum.zoom.us/u/maksym.rossiitsev)\ **Post date:** [October 11, 2022, 11:47pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/7 "2022-10-11T23:47:08Z")
Yes, and yes - it is Server-to-server, and it is activated. The only thing is that it says “Intend to publish: no” and that the app is not listed on the marketplace (I believe this is how it should be, but just to make sure). ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/f/0/f0462bd4bab13ee4140c2623d89a5df1ff139996.png) Another thing - there is a requirements block, and I’m not sure if it has anything to do with the problem. I’m not a global administrator in the organization, so wonder if this could be related. ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/c/a/ca857f3100d3e30a4bc9b38be54de40ae5508070.png) ---
**Author:** ![brandon.abajelo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brandon.abajelo/32/39183_2.png) [@brandon.abajelo](https://devforum.zoom.us/u/brandon.abajelo)\ **Post date:** [October 12, 2022, 4:27pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/8 "2022-10-12T16:27:45Z")
@maksym.rossiitsev as a final check, would you be willing to utilize this script we have available on our github? It’s a CLI tool for generating server-to-server oauth tokens. All you need handy is your client id, client secret, and account id. > **[GitHub - zoom/Server-to-Server-Oauth-Token: Utility script to generate a Zoom...](https://github.com/zoom/Server-to-Server-Oauth-Token)** > > Utility script to generate a Zoom Server-to-Server Oauth Token and copy to clipboard - GitHub - zoom/Server-to-Server-Oauth-Token: Utility script to generate a Zoom Server-to-Server Oauth Token and... If this still 400’s I think we can narrow down the issue to be account/role permission related. ---
**Author:** ![maksym.rossiitsev](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@maksym.rossiitsev](https://devforum.zoom.us/u/maksym.rossiitsev)\ **Post date:** [October 13, 2022, 12:37pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/9 "2022-10-13T12:37:44Z")
Hi @brandon.abajelo I have managed to make it work from the code, so it does seem like this could be an encoding issue (still doesn’t work from postman and curl, but that’s a different story I think) Thank you for the help! 🙂 ---
**Author:** ![brandon.abajelo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/brandon.abajelo/32/39183_2.png) [@brandon.abajelo](https://devforum.zoom.us/u/brandon.abajelo)\ **Post date:** [October 13, 2022, 3:44pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/10 "2022-10-13T15:44:32Z")
@maksym.rossiitsev glad to hear it worked! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [October 17, 2023, 7:21am UTC](https://devforum.zoom.us/t/server-to-server-oauth-400-response-on-token-generation/77267/11 "2023-10-17T07:21:28Z")
Closed on October 17, 2023, 7:21am UTC This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.