# OAuth Token Access Denied Issue - App ID 133481

**URL:** <https://community.servicem8.com/t/oauth-token-access-denied-issue-app-id-133481/206>\
**Category:** API & SDK\
**Created:** [June 1, 2025, 4:28pm UTC](https://community.servicem8.com/t/oauth-token-access-denied-issue-app-id-133481/206 "2025-06-01T16:28:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\
**Post date:** [June 1, 2025, 4:28pm UTC](https://community.servicem8.com/t/oauth-token-access-denied-issue-app-id-133481/206/1 "2025-06-01T16:28:25Z")

</div>

**Originally posted by Martin**

Dear ServiceM8 Support,

I’m experiencing an issue with OAuth API access for our registered application (App ID: 133481).

**Problem Description:**

- Successfully obtained OAuth access token through authorization code flow
- Token: 93737-euw2-5727568161b03275e7b676c2f48da2056e02992b
- When making API calls with Bearer token, receiving “access\_denied” redirect
- API endpoint tested: [https://api.servicem8.com/api/1.0/staff.json?limit=1](https://api.servicem8.com/api/1.0/staff.json?limit=1)

**Application Details:**

- App ID: 133481
- App Type: Web Service Hosted Add-on
- OAuth Scopes Requested: read\_staff staff\_activity read\_jobs read\_job\_categories read\_schedule read\_customers read\_job\_queues read\_tasks
- Redirect URI: http://localhost:5000/auth/servicem8/callback

**API Response:**  
The API returns HTML with meta refresh to /access\_denied page instead of JSON data.

**Questions:**

1. Are there additional permissions needed for the OAuth token to access staff data?
2. Is there a specific API endpoint or header format required for OAuth authentication?
3. Do we need to activate additional features for our application to access the API?

**Testing Done:**

- Verified token exchange successful with correct scopes
- Confirmed Bearer token format in Authorization header
- Tested with proper Accept: application/json headers

We’re building a team performance dashboard that needs to read staff timesheet and job data. Any guidance on resolving this access issue would be greatly appreciated.

Best regards,  
Team Performance Dashboard Development Team