# Get User API is giving invalid token error

**URL:** <https://devforum.okta.com/t/get-user-api-is-giving-invalid-token-error/19780>\
**Category:** OAuth/OIDC\
**Created:** [March 11, 2022, 4:26pm UTC](https://devforum.okta.com/t/get-user-api-is-giving-invalid-token-error/19780 "2022-03-11T16:26:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pravin29](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@pravin29](https://devforum.okta.com/u/pravin29)\
**Post date:** [March 11, 2022, 4:26pm UTC](https://devforum.okta.com/t/get-user-api-is-giving-invalid-token-error/19780/1 "2022-03-11T16:26:28Z")

</div>

Get User API is giving invalid token error

We are using below endpoint to get access token  
username and password is clientID and secret  
In body we are passing Grant\_type as client\_credentials and scope as ‘ABC’  
We are getting access token

[https://XXX.oktapreview.com/oauth2/default/v1/token](https://XXX.oktapreview.com/oauth2/default/v1/token)

We are using below endpoint to get user list using the access token we got above  
[https://XXX.oktapreview.com/api/v1/users/](https://XXX.oktapreview.com/api/v1/users/)

We are passing Authorization header as SSWS $accesstoken but we are getting below error

{  
“errorCode”: “E0000011”,  
“errorSummary”: “Invalid token provided”,  
“errorLink”: “E0000011”,  
“errorId”: “oaeXALA1nIbQ6iJI-hIepJCBw”,  
“errorCauses”:   
}

Can you please suggest if we are passing correct parameters

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [March 11, 2022, 10:04pm UTC](https://devforum.okta.com/t/get-user-api-is-giving-invalid-token-error/19780/2 "2022-03-11T22:04:06Z")

</div>

Few things for this one

1. If you want to use OAuth Access Tokens to authorize calls to Okta’s APIs, they _must_ be issued by the [Org Authorization server](https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server) ([https://XXX.oktapreview.com/oauth2/v1/token](https://XXX.oktapreview.com/oauth2/v1/token))
2. You must enable (in the Application configuration on the Okta admin console) and request (in your /token call) the appropriate [Okta API scope for the method/endpoint](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#scopes-and-supported-endpoints). In this case, you need okta.users.read
3. If you do get a valid Access Token back from the Org AS with the appropriate scopes, you will need to send it as Authorization: Bearer instead of SSWS. SSWS is only used for [API tokens](https://developer.okta.com/docs/guides/create-an-api-token/main/)
4. In order to use a Service App and Client Credentials flow with the Org AS to get tokens that you can use against Okta’s own management endpoints, you need to configure the app to use private key JWT auth.

I recommend following this guide that shows you how to set all this up so you can use a Service app to get OAuth Access Tokens that can interact with Okta’s endpoints: [Implement OAuth for Okta with a service app | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 9:49pm UTC](https://devforum.okta.com/t/get-user-api-is-giving-invalid-token-error/19780/3 "2024-02-08T21:49:05Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.