Server to Server OAuth: getting "Invalid access token", wants write scopes when it should only need read

API and Webhooks
1

I’m trying to pull a list of webinars, but when I do, I’m getting

Invalid access token, does not contain scopes: [webinar:write:admin, webinar:write]."

This is true, as I have webinar:read:admin. The documentation says that I only need read to read the list of webinars. Also, I don’t have webinar:write as an option in my scopes.

Code:

$accountid = "REDACTED";
$clientid = "REDACTED";
$secret = "REDACTED";

$url = "https://zoom.us/oauth/token?grant_type=account_credentials&account_id=" . $accountid;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$headers[] = "Authorization: Basic " . base64_encode($clientid . ":" . $secret);
$headers[] = "Content-Type: application/x-www-form-urlencoded";
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$data = curl_exec($ch);
$auth = json_decode($data, true); // token will be with in this json

var_dump( $auth );
$access_token = $auth['access_token'];

var_dump($access_token);


$webinar_get_url = "https://api.zoom.us/v2/users/user@domain.con/webinars";

curl_setopt($ch, CURLOPT_URL, $webinar_get_url);

$webinarheaders[] = "Authorization: Bearer " . $access_token;
curl_setopt($ch, CURLOPT_HTTPHEADER, $webinarheaders);

$data = curl_exec($ch);
$webinars = json_decode($data, true);

var_dump( $data ) ;

The result of the first vardump is

array (size=4)
  'access_token' => string 'REDACTED'... (length=632)
  'token_type' => string 'bearer' (length=6)
  'expires_in' => int 3599
  'scope' => string 'user:read:admin webinar:read:admin webinar_token:read:admin:live_streaming webinar_token:read:admin:local_archiving webinar_token:read:admin:local_recording' (length=156)

The result of the last vardump is

'{"code":4700,"message":"Invalid access token, does not contain scopes: [webinar:write:admin, webinar:write]."}'
2

Make sure you’re issuing a GET request, not a POST request. From a quick glance, this line looks suspicious:

2 Likes
3

This was it!
I just set it back to FALSE on the second request and everything worked.

1 Like
4

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.