Server-to-Server oAuth Access Token contains wrong scopes

API and Webhooks Authentication
1

API Endpoint(s) and/or Zoom API Event(s)

/oauth/token

Description
I am trying to develop an in-house server-to-server oAuth application to manage webinars/events.
For this I have created an app according to the documentation and created the credentials, assigned a scope (zoom_events:read:list_events:admin, zoom_events:read:event:admin,zoom_events:write:event:admin) and activated the app.

When retrieving the api endpoint /v2/zoom_events/events I get the following error message:

[code] => 104 [message] => Invalid access token, does not contain scopes:[zoom_events:read:list_events,zoom_events:read:list_events:admin]

This puzzled me, which is why I checked the creation of the AccessToken. When the AccessToken is created, it is returned but contains a completely different scope than the one defined in the app:

{
“access_token”: “XXXX”,
“token_type”: “bearer”,
“expires_in”: 3600,
“scope”: “marketplace:delete:event_subscription marketplace:read:list_event_subscriptions marketplace:update:event_subscription marketplace:write:event_subscription marketplace:write:websocket_connection”,
“api_url”: “api url”
}

I can reproduce this behavior via my PHP application, but also via Postman. I have already deactivated the app, reactivated it and finally created a completely new app. Again with the same result.
Of course, the account has the necessary licenses for Zoom events.

Does anyone recognize an error or could there be a bug in the API?

Error?
AccessToken contains a completely different scope

How To Reproduce

*1. Request an AccessToken

3

Hi @AFjutou can you remove the scopes, re-add and then generate a new access token before hitting the endpoint?

4

Hi @gianni.zoom,
Thanks for answering!
I tried it the way you suggested. Unfortunately, this did not solve the problem. The endpoint /oauth/token still returns an AccessToken with the wrong scope. This is still:

“access_token": ‘XXX’,
“token_type": ‘bearer’,
“expires_in": 3600,
“scope": ‘marketplace:delete:event_subscription marketplace:read:list_event_subscriptions marketplace:update:event_subscription marketplace:write:event_subscription marketplace:write:websocket_connection’,
“api_url": ”api url”

5

Hi @AFjutou just messaged you for more information! Please check your notifications.

6

Hello @AFjutou , I opened up a support ticket for your via your email. Can you please check? (TS1678634)