# Server-to-Server OAuth: annoying token-invalidation

**URL:** <https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070>\
**Category:** Authentication\
**Created:** [July 12, 2022, 11:00am UTC](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070 "2022-07-12T11:00:01Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [September 15, 2022, 3:36pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070/8 "2022-09-15T15:36:44Z")

</div>

The crucial tidbit of information I was missing is the correct parameter name `token_index` as described in:

> [@Randomly receiving "Invalid access token" for Server-to-Server OAuth](https://devforum.zoom.us/t/randomly-receiving-invalid-access-token-for-server-to-server-oauth/74432/22):
>
> The token index is specified in the call to [https://zoom.us/oauth/token](https://zoom.us/oauth/token) by passing the `token_index` query parameter ([https://zoom.us/oauth/token?token\_index=2](https://zoom.us/oauth/token?token_index=2))

When this `token_index` is out of range, you’ll receive an HTTP 400 response code with the body `{"reason":"Invalid request : Maximum group number limit exceeded","error":"invalid_request"}`.

**Update (27 September 2022)**: Developer Support has explained that the number of simultaneous token index values is limited to 3 concurrent tokens due to the “higher security risk of having more index token [sic]. Our back end can’t increase it to more than 3 index token [sic] without a genuine business impacting use case, considering the security.” I’m still getting the group limit exceeded error message described earlier when trying to use any of the additional `token_index` values above 0, so my personal recommendation is to save yourself the trouble of working with Developer Support and just create duplicate identical applications for however many concurrent tokens you need.

---

_[View the full topic](https://devforum.zoom.us/t/server-to-server-oauth-annoying-token-invalidation/72070)._