# Trial account trying to create user using api v2 oauth PHP "\[message\] =\> Invalid api key or secret."

**URL:** <https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643>\
**Category:** API and Webhooks\
**Created:** [January 22, 2020, 9:31pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643 "2020-01-22T21:31:47Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 22, 2020, 9:31pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/1 "2020-01-22T21:31:47Z")

</div>

**Description**  
Greetings, I’m new to Zoom V2, although I have been using Zoom V1 API for a few months.

For this problem, I am using pure PHP 7.n to experiment with v2 commands.

I have a clientID and clientSecret.

For the very first test, get oauth token, works:

```
        public function getToken(){
            $params['params'] = array(
                                "grant_type" => "client_credentials",
                                "client_id" => $this->clientID,
                                "client_secret" => $this->clientSecret
                            );
            $params['url'] = "https://zoom.us/oauth/token";
            return $this->makeRequest($params);
        }

```

…where $this-\>getToken()-\>access\_token will return a long oauth token string.

Then I try to pass that oauth token to my next function, “createUser”, which looks like this:

```
        public function createUser($params)
        {
            $params['url'] = "https://api.zoom.us/v2/users";
            $params['userInfo'] = array(
                                         "email" => "iuytfdfghjhg77@gmail.com",
                                         "type" => 1,
                                         "first_name" => "Gregory",
                                         "last_name" => "George"
                                        );

            $params['params'] = array(
                                       "access_token" => $this->getToken()->access_token,
                                       "action" => "create",
                                       "user_info" => $params['userInfo']
                                     );
            return $this->makeRequest($params);
        }

```

…where $this-\>makeRequest($params) does a cURL, and returns the response object.

**Error**  
The response from my “createUser” function looks like this:

```
stdClass Object(
                    [code] => 200
                    [message] => **Invalid api key or secret.**
                )
```

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [January 22, 2020, 10:14pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/2 "2020-01-22T22:14:34Z")

</div>

Hey @gregory.george.lewis, thanks for posting and using Zoom!

Can you please try sending the access\_token via the [request header](https://stackoverflow.com/a/3032658/6592510) instead of a param?

`"Authorization": "Bearer ACCESS_TOKEN_HERE"`

[Also due note that our V1 APIs will be shut off soon.](https://marketplace.zoom.us/docs/guides/announcements#v1-eol)

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 22, 2020, 10:43pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/3 "2020-01-22T22:43:05Z")

</div>

> [@tommy](#):
>
> “Authorization”: “Bearer ACCESS\_TOKEN\_HERE”

Hi Tommy, thanks for the help.

I now pass the access\_token using httpheader, like so:

```
    public function makeRequest($params)
    {
        $params['params']['client_id'] = $this->clientID;
        $params['params']['clientSecret'] = $this->clientSecret;
        $curl = curl_init();
        curl_setopt_array($curl, array(
                                        CURLOPT_URL => $params['url'],
                                        CURLOPT_SSL_VERIFYPEER => true,
                                        CURLOPT_RETURNTRANSFER => true,
                                        CURLOPT_POST => true,
                                        CURLOPT_POSTFIELDS => http_build_query($params['params'])
                                       )
            );
        if(isset($params['access_token'])){
            curl_setopt($curl,CURLOPT_HTTPHEADER, array("Authorization : Bearer " . $params['access_token']));
        }
        $response = curl_exec($curl);
        curl_close($curl);
        return json_decode($response);
    }

```

The response object is the same as before:

```
stdClass Object

```

(  
[code] =\> 124  
[message] =\> Invalid access token.  
)

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [January 22, 2020, 11:12pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/4 "2020-01-22T23:12:53Z")

</div>

Hey @gregory.george.lewis,

Can you try removing the following code and try again?

```php
$params['params']['client_id'] = $this->clientID;
$params['params']['clientSecret'] = $this->clientSecret;

```

The ClientID and ClientSecret should not be passed into the POST `https://api.zoom.us/v2/users` endpoint.

Also can you share your use case? If your app is only being used within your Zoom account, [using a JWT Token](https://devforum.zoom.us/t/requesting-access-token-via-python/6637/2) is an easier flow.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 23, 2020, 2:30pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/5 "2020-01-23T14:30:32Z")

</div>

Thanks again, Tommy.

My use case will ultimately narrow down to two functions, on the client side where subscribers who fill out a form will generate a start\_url for the meeting manager, and on the admin side where we can obtain the data set for each meeting, and do something with that data, like measure how long it lasted. There may be a few other things we would like to do, but start\_url, join\_url, and meeting data are the major events.

* * *

I removed the ClientID and ClientSecret from each request, except for the original request to get the access\_token.

If I pass the access\_token in the POSTFIELDS, I get a :

```
stdClass Object
(
    [code] => 200
    [message] => Invalid api key or secret.
) 

```

…This indicates to me that the access\_token was successfully received (because the request does not return an invalid access token).

If I remove the access\_token from the POSTFIELDS and instead include it as a header using CURLOPT\_HEADER, I get a different error :

```
stdClass Object
(
    [code] => 124
    [message] => Invalid access token.
)

```

My cURL looks like this:

```
        $curl = curl_init();
        curl_setopt_array($curl, array(
                                        CURLOPT_URL => "https://api.zoom.us/v2/users",
                                        CURLOPT_SSL_VERIFYPEER => true,
                                        CURLOPT_RETURNTRANSFER => true,
                                        CURLOPT_POST => true,
                                        CURLOPT_POSTFIELDS => http_build_query(array(
                                            'action' => 'create',
                                            'user_info' => array(
                                                                 'email' => 'earthboar@gmail.com',
                                                                 'type' => '1',
                                                                 'first_name' => 'Gregory',
                                                                 'last_name' => 'George'
                                                                )
                                        )),
                                       )
        );
        CURL_SETOPT($curl,CURLOPT_HTTPHEADER, array("Authorization" => "Bearer eyJhbGciOiJIUzUxMiIsInYiOiIyLjAiLCJraWQiOiIwYmRkMmE4ZC0xZDkyLTRhYzctYTRjNC05NjhmYjNiYzU5NjIifQ.eyJhdWQiOiJodHRwczovL29hdXRoLnpvb20udXMiLCJ2ZXIiOiI2IiwibmJmIjoxNTc5Nzg4OTcwLCJjbGllbnRJZCI6Il9qckozV3c0VHFtbkQ5U1hBcGtpUVEiLCJpc3MiOiJ1cm46em9vbTpjb25uZWN0OmNsaWVudGlkOl9qckozV3c0VHFtbkQ5U1hBcGtpUVEiLCJhdXRoZW50aWNhdGlvbklkIjoiNDBjNjA2NDA5OTJjNDRmNTBlYThiZjJhOWJhMDM2NWEiLCJleHAiOjE1Nzk3OTI1NzAsInRva2VuVHlwZSI6ImNsaWVudF90b2tlbiIsImlhdCI6MTU3OTc4ODk3MCwidXNlcklkIjoiSEVWNFpCVmRSaXE0ZzBlNlFtSUtXUSIsImdyb3VwTnVtYmVyIjowLCJqdGkiOiI5NDhjZTY5NC04NTIwLTQ2NmUtYTljZi05OThkNjY5YzlkNTEifQ.f-gKyGsmlO-WyccPCXITLXarUyXBUBoyNIubQpEEaZYYW8GM79wOGnYH3nZZE5Ky6DbBKmuYwtnxQf2qWRhhnw"));
        $response = curl_exec($curl);
        curl_close($curl);

```

I don’t know what else to try. If there are any PHP API V2 examples out there, it would sure help me 🙂

Thank you.

---

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 23, 2020, 3:24pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/6 "2020-01-23T15:24:59Z")

</div>

Right now I’m using this on localhost (my laptop). Not sure if it’s important.

I found a similar problem here: [https://devforum.zoom.us/t/help-with-api-create-meeting-with-php/5189/5](https://devforum.zoom.us/t/help-with-api-create-meeting-with-php/5189/5)

I implemented the solution on that page, so now my cURL code looks like this:

```
        $headers = array(
                          "authorization: Bearer {$params['access_token']}",
                          "content-type: application/json"
                        );
        
        $curl = curl_init();
        curl_setopt_array($curl, array(
                                        CURLOPT_URL => "https://api.zoom.us/v2/users",
                                        CURLOPT_SSL_VERIFYPEER => false,
                                        CURLOPT_RETURNTRANSFER => true,
                                        CURLOPT_POST => true,
                                        CURLOPT_POSTFIELDS => json_encode(array(
                                            'action' => 'create',
                                            'user_info' => array(
                                                                 'email' => 'earthboar@gmail.com',
                                                                 'type' => '1',
                                                                 'first_name' => 'Gregory',
                                                                 'last_name' => 'George'
                                                                )
                                        )),
                                       )
        );
        CURL_SETOPT($curl,CURLOPT_HTTPHEADER, $headers);
        $response = curl_exec($curl);
        curl_close($curl);

```

This results in :

```
stdClass Object
(
    [code] => 200
    [message] => Invalid api key or secret.
)

```

Is an “api key or secret” different from the client\_id and client\_secret? Do I need to include an api\_key & api\_secret in addition to the access\_token?

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [January 23, 2020, 5:45pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/7 "2020-01-23T17:45:21Z")

</div>

Hey @gregory.george.lewis,

Can you try making the same request in [Postman](https://www.getpostman.com/downloads/)? I want to determine if the issue is with your code, or on Zoom’s side with the api key / secret.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 24, 2020, 2:01am UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/8 "2020-01-24T02:01:07Z")

</div>

Working on it. My first time with Postman, so I’m learning it. My initial findings are, same response message:

```
{
  "code": 200,
  "message": "Invalid api key or secret."
}

```

In the URL space, I entered:

```
https://api.zoom.us/v2/users?api_key={my api key}&api_secret={my api secret key}&action=create&access_token={very long token string}

```

As a method, I selected POST. It’s highly likely my results reflect my lack of skill with Postman.

Also, I’m concurrently developing this script on a JWT app. Whichever one gets a valid response first wins.

Thanks again,

Gregory

---

<div class="post-metadata">

**Author:** ![gregory.george.lewis](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gregory.george.lewis/32/2974_2.png) [@gregory.george.lewis](https://devforum.zoom.us/u/gregory.george.lewis)\
**Post date:** [January 24, 2020, 3:28am UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/9 "2020-01-24T03:28:12Z")

</div>

I modified the code, somewhat, that I found on this page (already cited):  
[https://devforum.zoom.us/t/help-with-api-create-meeting-with-php/5189/5](https://devforum.zoom.us/t/help-with-api-create-meeting-with-php/5189/5)

I am applying the code to my JWT project. It works on createMeeting, in as much as I get a long, beautiful stdClass Object in the response.

I don’t think I solved the problem in the original post, but I will probably depart from OAuth for now, and build out using the JWT project.

Thanks!

Gregory

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [January 24, 2020, 4:50pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/10 "2020-01-24T16:50:15Z")

</div>

Hey @gregory.george.lewis,

For your OAuth or JWT request, this is the proper way to make it in Postman:

After `Bearer` add your JWT Token or you Access Token. THere is no need for api key and secret.

 ![Screen Shot 2020-01-24 at 9.49.16 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/c/c0a6fe7444d6d979af8207b2a0ea5dc057e14165.png)

Example:

 ![Screen Shot 2020-01-24 at 9.49.25 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/7/721ceb95d91c2094a99493dc0ce52ba1cc5fbf7c.png)

Let me know if you have additional questions 🙂

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\
**Post date:** [August 21, 2020, 7:12pm UTC](https://devforum.zoom.us/t/trial-account-trying-to-create-user-using-api-v2-oauth-php-message-invalid-api-key-or-secret/7643/11 "2020-08-21T19:12:56Z")

</div>

Closed on August 21, 2020, 7:12pm UTC