# Unable to generate OAuth token receiving 400 Bad Request error

**URL:** <https://devforum.zoom.us/t/unable-to-generate-oauth-token-receiving-400-bad-request-error/143443>\
**Category:** Meetings\
**Tags:** api\
**Created:** [May 8, 2026, 8:46am UTC](https://devforum.zoom.us/t/unable-to-generate-oauth-token-receiving-400-bad-request-error/143443 "2026-05-08T08:46:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sivakumar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/sivakumar/32/74494_2.png) [@Sivakumar](https://devforum.zoom.us/u/Sivakumar)\
**Post date:** [May 8, 2026, 8:46am UTC](https://devforum.zoom.us/t/unable-to-generate-oauth-token-receiving-400-bad-request-error/143443/1 "2026-05-08T08:46:51Z")

</div>

Unable to generate OAuth token receiving 400 Bad Request error

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/c/2/c25b234ddd934761c77bfdab32ce24958a7d1e42.png)

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [May 12, 2026, 6:44am UTC](https://devforum.zoom.us/t/unable-to-generate-oauth-token-receiving-400-bad-request-error/143443/2 "2026-05-12T06:44:57Z")

</div>

@Sivakumar I’m doing something like this on nodejs

app.get(‘/oauthrefreshtoken’, async (req, res) =\> {  
const refreshToken = req.query.code;  
const clientId = process.env.ZOOM\_OAUTH\_USERLEVEL\_CLIENT\_ID;  
const clientSecret = process.env.ZOOM\_OAUTH\_USERLEVEL\_CLIENT\_SECRET;

if (!refreshToken) {  
return res.status(400).json({ error: ‘Missing ?code=refresh\_token parameter’ });  
}

try {  
const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString(‘base64’);  
const response = await axios.post(  
‘[https://zoom.us/oauth/token](https://zoom.us/oauth/token)’,  
new URLSearchParams({  
refresh\_token: refreshToken,  
grant\_type: ‘refresh\_token’,  
}).toString(),  
{  
headers: {  
Authorization: `Basic ${credentials}`,  
‘Content-Type’: ‘application/x-www-form-urlencoded’,  
},  
}  
);

```
res.status(200).json(response.data);

```

} catch (error) {  
res.status(500).json({ error: error.response?.data || error.message });  
}  
});

If you put in your refresh token to [jwt.io](http://jwt.io), you should be able to see details like expiry date etc..

I’ve dedacted my own refresh token, but it should be like this format

eyJzdiI6IjAwMDAwMiIsImFsZyI6IkhTNTEyIiwidiI6IjIuMCIsImtpZCI6IjlhYmQwNjc0LWE3ZmUtNDhiMy04ZDU5LTQ4MTE4Y2I1ZWI5OSJ9.eyJhdWQiOiJodHRwczovL29hdXRoLnpvb20udXMiLCJ1aWQiOiJwSjhaR2tBRVFzU0w3eHlSaWFaU1ZBIiwidmVyIjoxMCwiYXVpZCI6ImFkMmUyMzc1NWExY2Q5ZjhiYmQ3ZDBhMzQ0NDhlMWEzZWYwOWEwYTI5MzE0NDM5MmY2ZjA0YmI0MTRlZTAyZDAiLCJuYmYiOjE3Nzg1NjgwOTYsImNvZGUiOiJRTGgzMjRLNjxxxxxxxxxxxxxxxxxxxxxx3Nzg1NjgwOTYsImFpZCI6IjlzU19QQjJ5UjgyN25tdHNzZzl3Z1EifQ.E\_lD62P1q9wzggN1EwExOSTTqgTLB9ar-63ijTtUSMXX4xxxxxxxxxxxxxxxeFTS4q1Iw

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/d/6/d6ec406d18eba005ed288041cd894259eacced38.jpeg)

The refresh\_token you are providing looks more like an initial code to request for access and refresh token