# Server-to-Server OAuth response **URL:** \ **Category:** API and Webhooks\ **Tags:** api, server-to-server\ **Created:** [December 2, 2022, 11:54am UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648 "2022-12-02T11:54:13Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![EVant](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/evant/32/3511_2.png) [@EVant](https://devforum.zoom.us/u/EVant)\ **Post date:** [December 2, 2022, 11:54am UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/1 "2022-12-02T11:54:13Z")
Hello I’m converting a JWT application to the Server-to-Server OAuth method. The response of the initial request returns 4 values: - access\_token - token\_type - expires\_in - scope Does the header format changes ? Do we need to use the scope in any manner ? With the access\_token received using `https://zoom.us/oauth/token` I request an end point adding the following headers `{'Authorization': 'Bearer {access_token}', 'Content-type': 'application/json'}` but the result is 400 error : `{'code': 200, 'message': 'Invalid api key or secret.'}` What’s wrong ? Thanks ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [December 2, 2022, 2:48pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/2 "2022-12-02T14:48:30Z")
@EVant , Thank you for posting in the zoom developer forum --I’m happy to help here! As a start, can you share a screenshot of the code snippet used to handle the server-to-server request? In the meantime, to help developers get started fast, we create some Server-to-Server OAuth samples. I’ve linked the sample apps below for your reference. > **[GitHub - zoom/s2s-oauth-starter: Starting point for developing a Zoom S2S...](https://github.com/zoom/s2s-oauth-starter)** > > Starting point for developing a Zoom S2S OAuth API - GitHub - zoom/s2s-oauth-starter: Starting point for developing a Zoom S2S OAuth API > **[GitHub - zoom/server-to-server-oauth-token: Utility script to generate a Zoom...](https://github.com/zoom/server-to-server-oauth-token)** > > Utility script to generate a Zoom Server-to-Server Oauth Token and copy to clipboard - GitHub - zoom/server-to-server-oauth-token: Utility script to generate a Zoom Server-to-Server Oauth Token and... Let me know if you have questions. ---
**Author:** ![scott](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@scott](https://devforum.zoom.us/u/scott)\ **Post date:** [December 2, 2022, 3:37pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/3 "2022-12-02T15:37:58Z")
Where do I find the account\_id? My marketplace url is [App Marketplace](https://marketplace.zoom.us/develop/apps/%5BREDACTED%5D) /credentials, so I tried to use Sh…XA, but that didn’t work. When I post POST /oauth/token?grant\_type=account\_credentials&account\_id=[REDACTED] HTTP/1.1 Host: [zoom.us](http://zoom.us) User-Agent: GuzzleHttp/7 Content-Type: application/json Authorization: Basic RxxxxxxZQ Content-Length: 2 I get a response of unsupported grant type ---
**Author:** ![EVant](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/evant/32/3511_2.png) [@EVant](https://devforum.zoom.us/u/EVant)\ **Post date:** [December 2, 2022, 4:28pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/4 "2022-12-02T16:28:31Z")
This is the Python code to get the token and generate the headers ```auto with httpx.Client(auth=(ClientId,ClientSecret)) as client: params = {'grant_type': 'client_credentials'} r = client.post('https://zoom.us/oauth/token', params=params) token = r.json()["access_token"] headers = {'Authorization': f'Bearer {token}', 'Content-type': 'application/json'} ``` The response seems ok `{"access_token":"eyJhbGciOiJIUzUx....J7hfYQ","token_type":"bearer","expires_in":3600,"scope":"meeting:master meeting:read:admin meeting:read:admin:sip_dialing meeting:write:admin meeting_token:read:admin:live_streaming meeting_token:read:admin:local_archiving meeting_token:read:admin:local_recording recording:master recording:read:admin recording:write:admin room:master room:read:admin room:write:admin user:master user:read:admin user:write:admin webinar:master webinar:read:admin webinar:write:admin webinar_token:read:admin:live_streaming webinar_token:read:admin:local_archiving webinar_token:read:admin:local_recording"}` With this header I then call an a end point ```auto with httpx.Client(http2=True, headers=headers, verify=True) as client: url = f'https://api.zoom.us/v2/users/{id}/meetings?\ page_number=1&page_size=300&type={meetingtype}' r = client.get(url) ``` ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [December 2, 2022, 5:11pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/5 "2022-12-02T17:11:13Z")
@EVant, Thanks for sharing. It looks like you were able to get up and running. For reference, here is another simple Python script you can use to get the Access token with your server -to-server App credentials: ```auto import requests url = "https://zoom.us/oauth/token?grant_type=account_credentials&account_id={YOUR_ACCOUNTID}" payload = "" headers = { 'Authorization': 'Basic {token}' } response = requests.request("POST", url, headers=headers, data=payload) print(response.text) ``` ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [December 2, 2022, 5:19pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/6 "2022-12-02T17:19:39Z")
@scott , Welcome to the Zoom Developer Forum. For context, are you looking for your account id to use with server to -server OAuth? Or are you asking for general knowledge? If the latter, the Get a user API response will include the account id. If the former, when you create a Server-to-server app, you can find your account on the App credentials screen of your Marketplace App. Here is a screenshot of what that looks like : ## Server-to-server app credentials screenshot: ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/c/bccd041b3fc029e176dd6f9be5cd3bd8c7ca9709.png) ## Get a user API [https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#operation/user](https://marketplace.zoom.us/docs/api-reference/zoom-api/methods/#operation/user) ---
**Author:** ![EVant](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/evant/32/3511_2.png) [@EVant](https://devforum.zoom.us/u/EVant)\ **Post date:** [December 2, 2022, 5:32pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/7 "2022-12-02T17:32:38Z")
Sorry, I don’t understand everything. In your example your are using `account_credentials` What is the difference with `client_credentials` ? Do I need to use the first request with `Client_Id` and `Client_Secret` to get a token and then use it with your script above ? I tried your request (alone) with postman and it generates an error `{"reason":"Invalid Client Id and Client Secret","error":"invalid_client"}` ---
**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\ **Post date:** [December 2, 2022, 5:52pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/8 "2022-12-02T17:52:30Z")
Great question, @EVant ! You can use client\_credentials or account\_credentials with the Server-to-server. See our Server-to-Server OAuth support documentation for a detailed description of the difference between account\_credentials and client\_credentials ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/1/0/100720dce388825f2ad25c2a6254ed9502835fbf.png) # Create a Server-to-Server OAuth app [https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/](https://marketplace.zoom.us/docs/guides/build/server-to-server-oauth-app/) > [@EVant](#): > > Do I need to use the first request with `Client_Id` and `Client_Secret` to get a token and then use it with your script above? The code snippet was actually provided via a successful Server-to-server Postman request. Here is a screenshot of how the request was setup in Postman for context : # Postman Params Tab ![Screen Shot 2022-12-02 at 12.47.19 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/7/b71d89ff12085516f4a95aef95b130d724a458d7.png) # Postman Authorization Tab ![Screen Shot 2022-12-02 at 12.50.40 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/c/b/cb8b40b23955144d7a41d4fcb860368a752ac60b.png) ---
**Author:** ![scott](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@scott](https://devforum.zoom.us/u/scott)\ **Post date:** [December 2, 2022, 9:41pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/9 "2022-12-02T21:41:21Z")
Thanks!! The reason I was having such a hard time is that I had made an OAuth app instead of a Server-to-server OAuth app. I didn’t realize they were different. Couldn’t figure out why it was giving me a refresh token… ---
**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\ **Post date:** [December 6, 2022, 5:43pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/10 "2022-12-06T17:43:58Z")
Thank you for providing your feedback there. We’ll see if we can improve our documentation around this to make it more clear. ---
**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\ **Post date:** [December 6, 2022, 5:44pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-response/79648/11 "2022-12-06T17:44:14Z")
Closed on December 6, 2022, 5:44pm UTC