## TL;DR

Zoom error 124 means the access token is expired, revoked, or malformed. Refresh the OAuth token, or regenerate the Server-to-Server OAuth credentials, update the client, and the calls work again. Do not retry the same dead token hoping it recovers.

A dead token never comes back to life. Replace it.

## Verbatim query

```text
zoom API error 124: Invalid access token
```

## Steps

1. Check the token's age and expiry
   Note when the token was issued and its lifetime. If it is past expiry, that is the cause.
   Expected: You know whether the token is expired or not.

2. Refresh or regenerate the credential
   For OAuth user tokens, refresh through the token endpoint with the refresh token. For Server-to-Server OAuth, regenerate the account credentials.
   Expected: A fresh access token in hand.

3. Update the client configuration
   Replace the old token wherever the generated client stores or caches it.
   Expected: The client sends the fresh token on the next request.

4. Retry the failing call
   Send the same request again with the new token.
   Expected: A 200 response instead of error 124.

5. Add automatic refresh to the generated client
   Refresh the token proactively before expiry instead of waiting for 124 to appear.
   Expected: The client self-renews tokens and 124 stops occurring.

## Use this when

- Zoom returns error 124 "Invalid access token" on API calls.
- A previously working integration starts failing every call at once.
- The token was issued a while ago and never refreshed.

## Not for this skill when

- The 124 comes with a valid token and the real problem is missing scopes on the Zoom app.
- The failure is caused by calling the wrong base URL.
- The problem is webhook secret validation, which is a different error.

## Variant phrasings

### "Invalid access token" code 124 on users or meetings endpoints

The endpoint does not matter. An expired token fails everywhere the same way.

## Why it happens

Zoom access tokens are short-lived by design. Generated clients typically fetch a token once during setup and reuse it indefinitely, with no refresh logic. The integration works until the token expires, then every call fails with 124 at the same time.

## Edge cases

- Server clock skew can make a JWT-based token appear expired early or be rejected; check clock sync if fresh tokens still fail.
- Server-to-Server OAuth credentials are account-level; user-level OAuth tokens are per-user. Do not mix the two.
- A Zoom app missing the scope for the endpoint fails even with a fresh token; that is a scope problem, not a token problem.
- Cached tokens in long-lived workers or across deploys keep serving the dead token; clear every cache layer.
- Revoking the app or rotating the client secret kills outstanding tokens immediately.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_66saeB9uDqKpzpEMPfCAwg