# Server-to-Server OAuth returns 400 invalid\_request

**URL:** <https://devforum.zoom.us/t/server-to-server-oauth-returns-400-invalid-request/146519>\
**Category:** API and Webhooks\
**Created:** [September 17, 2026, 3:02am UTC](https://devforum.zoom.us/t/server-to-server-oauth-returns-400-invalid-request/146519 "2026-09-17T03:02:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![poorna\_sai](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/poorna_sai/32/65849_2.png) [@poorna\_sai](https://devforum.zoom.us/u/poorna_sai)\
**Post date:** [September 17, 2026, 3:02am UTC](https://devforum.zoom.us/t/server-to-server-oauth-returns-400-invalid-request/146519/1 "2026-09-17T03:02:59Z")

</div>

### Hello Zoom Developer Support/Community,

I am integrating Zoom Live Classes and student attendance into an [ASP.NET](http://ASP.NET) Core application using a Server-to-Server OAuth application.

My S2S OAuth token request consistently returns:

HTTP 400 Bad Request

{“reason”:“Bad Request”,“error”:“invalid\_request”}

I have verified:

- App type: Server-to-Server OAuth
- App level: Account-level
- App status: Activated
- App owner: Zoom Account Owner
- Account ID: copied directly from App Credentials
- Client ID: copied directly from App Credentials
- Client Secret: regenerated and copied directly from App Credentials
- Required participant scope: meeting:read:participant:admin

I tested the OAuth request independently of my [ASP.NET](http://ASP.NET) Core application using both PowerShell and curl.exe.

I tested the documented application/x-www-form-urlencoded request:

POST [https://zoom.us/oauth/token](https://zoom.us/oauth/token)

Body:  
grant\_type=account\_credentials&account\_id=\<ACCOUNT\_ID\>

Authorization:  
Basic \<Base64(client\_id:client\_secret)\>

The same invalid\_request error occurs with the query-string format as well.

Zoom tracking ID:

v=2.0;clid=us05;rid=WEB\_7405b2a64fd12a7b7bcd517380a015d4

Could someone please help identify why the active S2S OAuth application is returning invalid\_request?

I have not included my Client Secret for security reasons.

Thank you.

---

<div class="post-metadata">

**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\
**Post date:** [September 17, 2026, 3:38pm UTC](https://devforum.zoom.us/t/server-to-server-oauth-returns-400-invalid-request/146519/2 "2026-09-17T15:38:29Z")

</div>

To be sure, have you included a `Content-Type: application/x-www-form-urlencoded; charset=utf-8` HTTP header alongside the request body? In .NET, I believe this will be populated when using the [FormUrlEncodedContent class](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.formurlencodedcontent).

Zoom has a sample [Node.js implementation of Server-to-Server OAuth Tokens](https://github.com/zoom/server-to-server-oauth-token) that you can review.