Server-to-Server OAuth token has scope, but Zoom API still returns 4711 error

API and Webhooks
1

Hi Zoom Dev Team,

We’re integrating Zoom Webinars using the Server-to-Server OAuth flow (not standard OAuth) and running into a persistent issue with scopes.

What we’re doing:

  • We’ve created a Server-to-Server OAuth app using the account owner’s Zoom login

  • The app has been granted the following scopes:

    • webinar:read:list_webinars:master

    • webinar:write:registrant:master

  • We generate a token using:

    POST https://zoom.us/oauth/token?grant_type=account_credentials&account_id=...

    The token returns successfully and includes the correct scopes:

    { "scope": "webinar:read:list_webinars:master webinar:write:registrant:master", ... }

:cross_mark: The issue:

When we call this endpoint:

GET /accounts/{accountId}/users/{userId}/webinars

{ "code": 4711, "message": "Invalid access token, does not contain scopes: [webinar:read:list_webinars:master]" }

:test_tube: What we’ve already confirmed:

  • The app was created under the account owner

  • The token includes the expected scopes

  • The token is passed correctly as a Bearer token

  • The user has the webinar license

  • Zoom support confirmed the scopes are present and sent us here

:paperclip: Attachments:

I can share Postman screenshots showing:

  • Token generation (with scopes)

  • The API call

  • The 4711 error

Please let me know what else I can check — we’re trying to build webinar registration + attendance tracking via API, and this is blocking our progress.

token
token884×820 83.9 KB

error
error858×705 42.8 KB

Thanks in advance!

2

Hi @GeorgeF
Thanks for reaching out to us and happy to help!
Can you please confirm you have a Master account license in your account?

If you don’t, please use the following endpoints:

So basicaly you will need the scope webinar:read:list_webinars:admin in your application to be able to acces the List webinars endpoint.

And your request URL should look like this:

https://api.zoom.us/v2/users/me/webinars

The way you are generating your access token is correct