# URGENT ### {“reason”:”Invalid authorization code \*\*\*”,”error”:”invalid\_grant”}

**URL:** <https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973>\
**Category:** Zoom Apps\
**Created:** [March 1, 2023, 4:29pm UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973 "2023-03-01T16:29:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![thaicao](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/thaicao/32/44091_2.png) [@thaicao](https://devforum.zoom.us/u/thaicao)\
**Post date:** [March 1, 2023, 4:29pm UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973/1 "2023-03-01T16:29:46Z")

</div>

**Hello I am currently getting the error:**  
**I am using zoomappsdk for client side**  
{“reason”:“Invalid authorization code [REDACTED]”,“error”:“invalid\_grant”}

I used the zoomapp sdk and used the authorize and onauthorized functions on the client side to get the authorization code  
{code: “###”, result: true, timestamp: ###, redirectUri: "https://###.ngrok.io/”}

Then I send the code to the backend with a code\_verifier to then the server sends a post to  
“[https://zoom.us/oauth/token”](https://zoom.us/oauth/token%E2%80%9D) with the parameters

?grant\_type=authorization\_code&code=###&code\_verifier=###&redirect\_uri=###

No Luck ☹  
Can someone please help with this Ive been stuck on why its giving authorization code error the last two days  
**Heres what I am doing to run the current code challenge**

async function generateCodeChallenge() {  
// Generate a random string for the challenge  
const challenge = await generateRandomString(64);  
// Convert the challenge to a buffer  
const challengeBuffer = new TextEncoder().encode(challenge);

// Encode the buffer using plain encoding  
const codeChallenge = btoa(String.fromCharCode(…new Uint8Array(challengeBuffer)));

// Generate a random string for the verifier  
const verifier = await generateRandomString(64);

// Convert the verifier to a buffer  
const verifierBuffer = new TextEncoder().encode(verifier);

// Encode the buffer using base64  
const codeVerifier = btoa(String.fromCharCode(…new Uint8Array(verifierBuffer)));

return { codeChallenge, codeVerifier };  
}

**On the backend here is what I am running for calling zoom server**

const zoomtokenep = “[https://zoom.us/oauth/token”](https://zoom.us/oauth/token%E2%80%9D);  
sanitize(req)  
const myappredirect = req.query.redirectUri;  
console.log(“zoomcallback”)  
if (req.query.code) {  
console.log(“CODE VERIFIER”)  
console.log(req.query.code\_verifier)  
console.log(req.query.code)  
const zoomclientid = “Z\*\*\*”  
const zoomclientsec = “T\*\*\*”  
const auth = ‘Basic ’ + Buffer.from(zoomclientid + ‘:’ + zoomclientsec).toString(‘base64’);  
console.log(auth)  
var url = zoomtokenep + ‘?grant\_type=authorization\_code&code=’ +  
req.query.code + ‘&code\_verifier=’+req.query.code\_verifier +’&redirect\_uri=’ + myappredirect;  
request.post({  
url: url,  
headers: {  
“Content-Type”:“application/x-www-form-urlencoded”,  
“Authorization”: auth  
}  
}, function(error, response, body) {  
console.log(response)  
if (error) {  
console.log("Error when getting Zoom token = " + error);  
return;  
}  
body = JSON.parse(body);  
if (body.access\_token) {  
accessToken = body.access\_token;  
// Process and securely store these tokens  
res.send({ output: accessToken});  
} else {  
console.log(“FATAL - could not get zoom token”);  
}  
return;  
});

} else {  
console.log(“Missing code from Zoom”);  
}  
});

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [March 1, 2023, 10:16pm UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973/3 "2023-03-01T22:16:24Z")

</div>

This may have to do with how the code\_challenge is generated. To rule out if this is related to the code challenge generation, are you able to authorize the app without using PKCE?

Here’s an example of generating a code\_challenge from a verifier:

> <https://github.com/zoom/zoomapps-serverless-vuejs/blob/3fd0baadedfbd61e3090f0975f7a4b79931b25dc/functions/index.js#L71-L95>

Let me know if that helps.

---

<div class="post-metadata">

**Author:** ![michellebowerhz4](https://avatars.discourse-cdn.com/v4/letter/m/a4c791/32.png) [@michellebowerhz4](https://devforum.zoom.us/u/michellebowerhz4)\
**Post date:** [April 17, 2023, 7:55pm UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973/4 "2023-04-17T19:55:59Z")

</div>

thanks it is helpful for me

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [April 21, 2023, 1:04am UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973/5 "2023-04-21T01:04:51Z")

</div>

Great! I’m glad to hear that was helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [April 23, 2024, 4:41pm UTC](https://devforum.zoom.us/t/urgent-reason-invalid-authorization-code-error-invalid-grant/83973/6 "2024-04-23T16:41:33Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.