# Server-to-Server oAuth Access Token contains wrong scopes

**URL:** <https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600>\
**Category:** Authentication\
**Created:** [January 30, 2025, 2:27pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600 "2025-01-30T14:27:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AFjutou](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@AFjutou](https://devforum.zoom.us/u/AFjutou)\
**Post date:** [January 30, 2025, 2:27pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600/1 "2025-01-30T14:27:39Z")

</div>

**API Endpoint(s) and/or Zoom API Event(s)**

/oauth/token

**Description**  
I am trying to develop an in-house server-to-server oAuth application to manage webinars/events.  
For this I have created an app according to the documentation and created the credentials, assigned a scope (zoom\_events:read:list\_events:admin, zoom\_events:read:event:admin,zoom\_events:write:event:admin) and activated the app.

When retrieving the api endpoint /v2/zoom\_events/events I get the following error message:

[code] =\> 104 [message] =\> Invalid access token, does not contain scopes:[zoom\_events:read:list\_events,zoom\_events:read:list\_events:admin]

This puzzled me, which is why I checked the creation of the AccessToken. When the AccessToken is created, it is returned but contains a completely different scope than the one defined in the app:

{  
“access\_token”: “XXXX”,  
“token\_type”: “bearer”,  
“expires\_in”: 3600,  
“scope”: “marketplace:delete:event\_subscription marketplace:read:list\_event\_subscriptions marketplace:update:event\_subscription marketplace:write:event\_subscription marketplace:write:websocket\_connection”,  
“api\_url”: “api url”  
}

I can reproduce this behavior via my PHP application, but also via Postman. I have already deactivated the app, reactivated it and finally created a completely new app. Again with the same result.  
Of course, the account has the necessary licenses for Zoom events.

Does anyone recognize an error or could there be a bug in the API?

**Error?**  
AccessToken contains a completely different scope

**How To Reproduce**

\*1. Request an AccessToken

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [February 3, 2025, 7:04pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600/3 "2025-02-03T19:04:41Z")

</div>

> [@AFjutou](#):
>
> For this I have created an app according to the documentation and created the credentials, assigned a scope (zoom\_events:read:list\_events:admin, zoom\_events:read:event:admin,zoom\_events:write:event:admin) and activated the app.
> 
> When retrieving the api endpoint /v2/zoom\_events/events I get the following error message:
> 
> [code] =\> 104 [message] =\> Invalid access token, does not contain scopes:[zoom\_events:read:list\_events,zoom\_events:read:list\_events:admin]
> 
> This puzzled me, which is why I checked the creation of the AccessToken. When the AccessToken is created, it is returned but contains a completely different scope than the one defined in the app:
> 
> {  
> “access\_token”: “XXXX”,  
> “token\_type”: “bearer”,  
> “expires\_in”: 3600,  
> “scope”: “marketplace:delete:event\_subscription marketplace:read:list\_event\_subscriptions marketplace:update:event\_subscription marketplace:write:event\_subscription marketplace:write:websocket\_connection”,  
> “api\_url”: “api url”  
> }

Hi @AFjutou can you remove the scopes, re-add and then generate a new access token before hitting the endpoint?

---

<div class="post-metadata">

**Author:** ![AFjutou](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@AFjutou](https://devforum.zoom.us/u/AFjutou)\
**Post date:** [February 5, 2025, 11:08am UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600/4 "2025-02-05T11:08:18Z")

</div>

Hi @gianni.zoom,  
Thanks for answering!  
I tried it the way you suggested. Unfortunately, this did not solve the problem. The endpoint /oauth/token still returns an AccessToken with the wrong scope. This is still:

“access\_token": ‘XXX’,  
“token\_type": ‘bearer’,  
“expires\_in": 3600,  
“scope": ‘marketplace:delete:event\_subscription marketplace:read:list\_event\_subscriptions marketplace:update:event\_subscription marketplace:write:event\_subscription marketplace:write:websocket\_connection’,  
“api\_url": ”api url”

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [February 13, 2025, 5:40pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600/5 "2025-02-13T17:40:19Z")

</div>

Hi @AFjutou just messaged you for more information! Please check your notifications.

---

<div class="post-metadata">

**Author:** ![gianni.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gianni.zoom/32/32523_2.png) [@gianni.zoom](https://devforum.zoom.us/u/gianni.zoom)\
**Post date:** [February 19, 2025, 4:20pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-access-token-contains-wrong-scopes/125600/6 "2025-02-19T16:20:16Z")

</div>

Hello @AFjutou , I opened up a support ticket for your via your email. Can you please check? (TS1678634)