# Token signature invalid

**URL:** <https://devforum.zoom.us/t/token-signature-invalid/1587>\
**Category:** API and Webhooks\
**Created:** [August 10, 2018, 5:49pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587 "2018-08-10T17:49:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brian\_Biggs](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@Brian\_Biggs](https://devforum.zoom.us/u/Brian_Biggs)\
**Post date:** [August 10, 2018, 5:49pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587/1 "2018-08-10T17:49:52Z")

</div>

Hi,

Trying to hit [https://api.zoom.us/v2/users](https://api.zoom.us/v2/users) using an API key and secret that are currently working with v1 API calls and I’m getting the&nbsp;{“code”:124,“message”:“The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256”}&nbsp; result.

&nbsp;

I’m using the perl API from [jwt.io](http://jwt.io) and I’ve confirmed that the expire date is in the future and that the token being generated is the same as what the debugger at [jwt.io](http://jwt.io) says it should be.

&nbsp;

Do I need to obtain a new key a secret to work with v2 of the API?

&nbsp;

Thanks.

&nbsp;

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [August 10, 2018, 6:15pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587/2 "2018-08-10T18:15:24Z")

</div>

Hi Brain,

The keys should be the same, make sure that in your JWT that you have the following

Header&nbsp;

```
{
  "alg": "HS256",
  "typ": "JWT"
}

```

Payload

```
{
  "iss": "API-Key",
  "exp": 1536375251
}

```

Signature

```
HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  API-Secret)
```

---

<div class="post-metadata">

**Author:** ![Brian\_Biggs](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@Brian\_Biggs](https://devforum.zoom.us/u/Brian_Biggs)\
**Post date:** [August 10, 2018, 6:24pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587/3 "2018-08-10T18:24:37Z")

</div>

Hi Michael,

&nbsp;

Thank you. I have confirmed that I’m using the correct client id and secret in the right places when generating the token. Are you sure the older client id/secret will work? Based on another comment in this thread:&nbsp;[https://support.zoom.us/hc/en-us/community/posts/360017928426-OAuth-redirect-and-JWT-support&nbsp;](https://support.zoom.us/hc/en-us/community/posts/360017928426-OAuth-redirect-and-JWT-support%C2%A0) is kind of sounds like I have to get a new client id and secret from the “marketplace”. Is that correct?

&nbsp;

Thanks.

&nbsp;

---

<div class="post-metadata">

**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\
**Post date:** [August 10, 2018, 8:18pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587/4 "2018-08-10T20:18:15Z")

</div>

Hi Brian,&nbsp;

Would you be able to share and email your token at [developersupport@zoom.us](mailto:developersupport@zoom.us)? Regardless if you are using marketplace or not, if you are using JWT,&nbsp; the API credentials should be the same.

Correction, from last comment I made previously, instead of client\_id it should be API-key and for client\_secret, you should use API- secret.&nbsp;

You should be able to get the API key/secret from here. [https://developer.zoom.us/me/#api](https://developer.zoom.us/me/#api)

 ![](https://support.zoom.us/hc/user_images/BA_joNqRcOt-jbl8MDCXPQ.png)

&nbsp;

&nbsp;

---

<div class="post-metadata">

**Author:** ![Brian\_Biggs](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@Brian\_Biggs](https://devforum.zoom.us/u/Brian_Biggs)\
**Post date:** [August 10, 2018, 8:34pm UTC](https://devforum.zoom.us/t/token-signature-invalid/1587/5 "2018-08-10T20:34:40Z")

</div>

Hi Michael,

&nbsp;

I literally just now figured out the problem. I was adding a colon right after Bearer in the header. I’ve removed that.

It seems to be working now. Thanks for your help.

&nbsp;