zoom API error 124: Invalid access token

TL;DR

Zoom error 124 means the access token is expired, revoked, or malformed. Refresh the OAuth token, or regenerate the Server-to-Server OAuth credentials, update the client, and the calls work again. Do not retry the same dead token hoping it recovers.

A dead token never comes back to life. Replace it.

Verbatim query

zoom API error 124: Invalid access token

Steps

1. Check the token's age and expiry Note when the token was issued and its lifetime. If it is past expiry, that is the cause. Expected: You know whether the token is expired or not.

2. Refresh or regenerate the credential For OAuth user tokens, refresh through the token endpoint with the refresh token. For Server-to-Server OAuth, regenerate the account credentials. Expected: A fresh access token in hand.

3. Update the client configuration Replace the old token wherever the generated client stores or caches it. Expected: The client sends the fresh token on the next request.

4. Retry the failing call Send the same request again with the new token. Expected: A 200 response instead of error 124.

5. Add automatic refresh to the generated client Refresh the token proactively before expiry instead of waiting for 124 to appear. Expected: The client self-renews tokens and 124 stops occurring.

Use this when

• Zoom returns error 124 "Invalid access token" on API calls.
• A previously working integration starts failing every call at once.
• The token was issued a while ago and never refreshed.

Not for this skill when

• The 124 comes with a valid token and the real problem is missing scopes on the Zoom app.
• The failure is caused by calling the wrong base URL.
• The problem is webhook secret validation, which is a different error.

Variant phrasings

"Invalid access token" code 124 on users or meetings endpoints

The endpoint does not matter. An expired token fails everywhere the same way.

Why it happens

Zoom access tokens are short-lived by design. Generated clients typically fetch a token once during setup and reuse it indefinitely, with no refresh logic. The integration works until the token expires, then every call fails with 124 at the same time.

Edge cases

• Server clock skew can make a JWT-based token appear expired early or be rejected; check clock sync if fresh tokens still fail.
• Server-to-Server OAuth credentials are account-level; user-level OAuth tokens are per-user. Do not mix the two.
• A Zoom app missing the scope for the endpoint fails even with a fresh token; that is a scope problem, not a token problem.
• Cached tokens in long-lived workers or across deploys keep serving the dead token; clear every cache layer.
• Revoking the app or rotating the client secret kills outstanding tokens immediately.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_66saeB9uDqKpzpEMPfCAwg