Server-to-Server OAuth: Activated app returns 400 / invalid_client although credentials are verified

API and Webhooks Authentication
, ,
1

Hello Zoom Developer Support,

I am currently setting up a private integration using a Zoom Server-to-Server OAuth app to register participants for Zoom meetings via API.

Unfortunately, I am unable to obtain an access token from the Zoom OAuth endpoint, although the app appears to be configured correctly.

Current configuration:

  • App type: Server-to-Server OAuth
  • App status: Activated
  • Account level app
  • Zoom account: Pro
  • Required scope:
    meeting:write:registrant:admin
  • Intended use: Add paid seminar participants as meeting registrants via the Zoom API

Token endpoint used:

POST https://zoom.us/oauth/token

with:

grant_type=account_credentials

and the Zoom Account ID.

Client ID and Client Secret are sent using HTTP Basic Authentication (Client ID:Client Secret, Base64 encoded).

Problem:

The token request is rejected by Zoom with HTTP 400. In the integration environment, Zoom returns:

invalid_client

/

Invalid client_id or client_secret

I have verified the following:

  • The Server-to-Server OAuth app is activated.
  • Account ID, Client ID and Client Secret were copied directly from the Zoom App Marketplace.
  • The Client Secret has not been regenerated or changed.
  • The credentials were re-entered directly from Zoom to rule out a copy/paste or stored-value issue.
  • The request does not contain the Client ID or Client Secret as URL parameters.
  • The Client ID and Client Secret are sent only via the Basic Authorization header.

To rule out an issue with the third-party integration platform, I also tested the token request directly from Windows PowerShell, without Zapier or any other service in between.

The direct request to:

https://zoom.us/oauth/token

also results in HTTP 400 Bad Request.

Therefore, the issue appears to occur directly at the Zoom OAuth token endpoint rather than in the external integration.

I have also seen a recent report in this forum describing a very similar issue with an activated Server-to-Server OAuth app and the same registrant scope.

Could you please check whether there is currently a known issue with Server-to-Server OAuth token generation, or whether there could be an account-level / app provisioning issue affecting this app?

I am happy to provide additional technical details privately if required. For security reasons, I will not post the Account ID, Client ID or Client Secret publicly.

Thank you very much for your assistance.

Best wishes,
Katarina

2

hi @Katarina1 ,

it all works fine, but you need a few steps to do this.

Has your admin enabled you as a developer?
There are many developer settings in the admin roles section.

Then check your settings with those of this appp

All the best

John

3

Hi @expertswho,

thanks a lot for your reply.

I’ve checked the role settings. I’m the account owner and both “view” and “edit” are enabled for Zoom for Developers as well as S2S OAuth App. The Server-to-Server OAuth app itself is activated.

The configured granular scope is meeting:write:registrant:admin, which according to the current Zoom API documentation is the scope for Add a meeting registrant.

I’ve also tested the token request outside of Zapier directly via PowerShell, using Account ID, Client ID and Client Secret copied directly from the activated app, but the token endpoint still returns HTTP 400.

I’ll also compare the configuration with the GitHub sample you linked.

Best wishes,

Katarina