# Zoom auth redirect: invalid Invalid authorization code **URL:** \ **Category:** API and Webhooks\ **Created:** [April 9, 2020, 5:50am UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302 "2020-04-09T05:50:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![achuo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/achuo/32/5224_2.png) [@achuo](https://devforum.zoom.us/u/achuo)\ **Post date:** [April 9, 2020, 5:50am UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/1 "2020-04-09T05:50:27Z")
**Description** I tried to finish auth workflow with a auth app and got the following error. The strange part is it works for the most of time… Please see `How To Reproduce` session for more details. **Error** Zoom API error: invalid\_request, reason: Invalid authorization code mk1Cq8Pap6\_PatCmZLwQxKCZOUJsBwojQ" **Which App Type (OAuth / Chatbot / JWT / Webhook)?** OAuth **Which Endpoint/s?** [https://zoom.us/oauth/token?grant\_type=authorization\_code](https://zoom.us/oauth/token?grant_type=authorization_code) **How To Reproduce (If applicable)** 1. Prepare a state token with the following data: `{ "iam_user_id":"U-86dd1422-859e-4e47-ab80-4bfbd6c28755" "next_url": "www.nexturl.com" }` 2. Then I hit this URL with the above state token to start auth workflow: [https://zoom.us/oauth/authorize?response\_type=code&client\_id=t30obsgsRAa060Wc0SMw9Q&redirect\_uri=https%3A%2F%2Fmeetings-demo.apigateway.co%2Fzoom%2Foauth2%2Fredirect&state=](https://zoom.us/oauth/authorize?response_type=code&client_id=t30obsgsRAa060Wc0SMw9Q&redirect_uri=https%3A%2F%2Fmeetings-demo.apigateway.co%2Fzoom%2Foauth2%2Fredirect&state=)\ 3. Then zoom redirects me back the auth redirect URL I set, which is a http endpoint: [https://meetings-demo.apigateway.co/zoom/oauth2/redirect?code=mk1Cq8Pap6\_PatCmZLwQxKCZOUJsBwojQ&state=](https://meetings-demo.apigateway.co/zoom/oauth2/redirect?code=mk1Cq8Pap6_PatCmZLwQxKCZOUJsBwojQ&state=)\ 4. In this http endpoint, i tried to use the returned code to get an auth token but got the above error. 5. This only happened only after I already used the same `IAM_user_id` to get a token before (and it worked). The auth workflow would work again if I change `IAM_user_id` to something else, say: `fake_id` **Screenshots (If applicable)** ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/f/fa3f724fe94903254bde85a2b5fd5029f4965298.png) **Additional context** Add any other context about the problem here. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 9, 2020, 10:24pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/2 "2020-04-09T22:24:25Z")
Hey @achuo, Have you tried passing in your state token url encoded or base 64 encoded? Thanks, Tommy ---
**Author:** ![achuo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/achuo/32/5224_2.png) [@achuo](https://devforum.zoom.us/u/achuo)\ **Post date:** [April 9, 2020, 11:01pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/3 "2020-04-09T23:01:53Z")
Nope, will that affect the behaviour of zoom auth workflow? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 10, 2020, 8:49pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/4 "2020-04-10T20:49:47Z")
Hey @achuo, I think you are getting that error because you are passing in a json object as the state param. Please try base64encoding the object or url encoding it so it is url safe. Thanks, Tommy ---
**Author:** ![achuo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/achuo/32/5224_2.png) [@achuo](https://devforum.zoom.us/u/achuo)\ **Post date:** [April 13, 2020, 2:45pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/5 "2020-04-13T14:45:18Z")
Hey @tommy, I will give it a try. Thanks for the help! ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 14, 2020, 6:53am UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/6 "2020-04-14T06:53:42Z")
You are welcome @achuo! Let me know if that works! 🙂 -Tommy ---
**Author:** ![achuo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/achuo/32/5224_2.png) [@achuo](https://devforum.zoom.us/u/achuo)\ **Post date:** [April 14, 2020, 2:51pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/7 "2020-04-14T14:51:06Z")
Hey @tommy I url encoded my state token but I still got the error `Error processing zoom oauth2 redirect request: the code [ibcgiRImMi_PatCmZLwQxKCZOUJsBwojQ] for exchanging OAuth token is invalid`. Can you check your logs to see what happened??? It worked again (with or without url encoding state token) ONLY AFTER I fully deleted my existing token in the database… However, the database in my system only supports soft delete (by adding deleted date to a row) and this error occurred when I soft deleted my token and re-authed. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 15, 2020, 8:20pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/8 "2020-04-15T20:20:11Z")
Hey @achuo, > [@achuo](#): > > `Error processing zoom oauth2 redirect request: the code [ibcgiRImMi_PatCmZLwQxKCZOUJsBwojQ] for exchanging OAuth token is invalid` . It seems you must be using an old code. Make sure once you get an access\_token the first time, you use the [refresh flow to get a new access\_token](https://marketplace.zoom.us/docs/guides/auth/oauth#refreshing), and not the original get get access token request passing in the code `ibcgiRImMi_PatCmZLwQxKCZOUJsBwojQ`. Thanks, Tommy ---
**Author:** ![achuo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/achuo/32/5224_2.png) [@achuo](https://devforum.zoom.us/u/achuo)\ **Post date:** [April 15, 2020, 8:35pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/9 "2020-04-15T20:35:44Z")
Hey @tommy Sometimes we wanna to delete an existing token to retest auth workflow. Do you think it would help if I revoke my existing token first before doing re-auth? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 16, 2020, 5:57am UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/10 "2020-04-16T05:57:41Z")
Hey @achuo, Revoking should not make a difference. If you start from [Step 1, going to the install / authorize URL](https://marketplace.zoom.us/docs/guides/auth/oauth#getting-access-token) it should work every time. 🙂 Thanks, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 8:25pm UTC](https://devforum.zoom.us/t/zoom-auth-redirect-invalid-invalid-authorization-code/12302/11 "2020-08-21T20:25:10Z")