Kaizen #116 - Client Types in Zoho API Console

Hello everyone!

Welcome back to another post in the Kaizen series!

This week, we will discuss different client types available in Zoho API Console, and when to use each.

When you register an app in Zoho API Console, you typically choose a client type based on how your application interacts with Zoho services.

Let us discuss the available client types and how authorization is handled for each.

Available client types

1. Server-based
   
2. Client-based
   
3. Self client
   
4. Non-browser-based
   
5. Mobile-based

1. Server-based

If you have a web-based application that runs on a dedicated HTTP server and interacts with Zoho services by calling Zoho APIs via that server, you must register your app with this client type.

This client type is for applications that redirect the users to another URL on a web browser to authorize themselves, where they give consent to your application to use their data.

In other words, you must use this client type when you have a front-end web UI and require user intervention before your app can access user data via the dedicated server.

Consider that you are developing a web-based custom application. Users authorize that app via browser to allow their Zoho CRM data to be accessed and used by that application.

During the registration process in Zoho API Console, you would choose the "Web-based" client type.

OAuth 2.0 would be used for user authentication, allowing your app to securely access and interact with Zoho CRM data on behalf of the users.

Here is a gist of what happens:

1. Users visit your website where you have the Login with Zoho button.
   
2. When a user clicks it, that user will be redirected to accounts.zoho.com with the details of your app such as client ID, scope, redirect uri, access type as the URL parameters.
   
3. Your app must make an API call to Zoho Accounts with the client ID, scope, redirect uri, and access type. Users are shown the data that your application wants to use.
   
4. When users give their consent, Zoho redirects them back to your app.This will be the "Redirect URL" you give while registering your app.
   
5. The redirect URL will have the authorization code(grant token) as one of the parameters, along with the location(user's domain).
   
6. Your app must then make API calls from your web server to Zoho Accounts to generate access and refresh tokens with the generated grant token.
   
7. You must store these tokens in your DB to access that user's data in Zoho CRM. While making API calls, you must send this access token in the header.
   
8. Your app must also have the logic to regenerate access tokens from refresh tokens when the access token expires.
   

Note that your app must take care of storing user's details like email, organization ID, and tokens.

The following image shows the protocol flow.

You can use any of our server-side SDKs to simplify this process.

When you use our SDK, all you have to do is, generate the grant token and initialize the SDK with the client details and this token. The SDK takes care of access token generation, refreshing it, and token storage.

Refer to these older Kaizen posts on Integrating a third-party app using Java SDK and Java SDK for Self Client.

For more details, you can refer to the Accounts guide and CRM help doc.

2. Client-based applications

This client type is for applications that do not have a server and run exclusively on a web browser.

This is also called the Implicit flow as your app makes API calls to Zoho only when users are using your app.

This type of application loads data dynamically on the webpage, and accesses Zoho CRM data by making API calls via Javascript.

Consider the same example where there is a Login with Zoho button on your webpage.

Here is a gist of what happens when a user clicks it.

1. Your app redirects the user to Zoho Accounts.
   
2. Your app makes the authorization request with the client ID, redirect uri, scope, and response type as token.
   
3. The user is shown the data that your webpage would use.
   
4. When the user gives consent, Zoho Accounts sends the access token to the redirect uri as a parameter, along with the expiry time and the location of user's data in Zoho's accounts server.
   
5. You can include the "email" in your scope parameter in the access token request to get user's information. The response will have a parameter called id_token that will be in the header.payload.signature format. You need to decrypt the payload section of the parameter using the base-64 decryption algorithm to get user information.
   
6. Your app must then make API calls to Zoho with this access token to fetch data.
   
7. When the access token expires, your app must take care of regeneration and storage.
   

As the API calls are made from your domain to a different domain(zohoapis.com), for security reasons, the browser will throw the CORS error. So, your domain will be registered while registering your app, and Zoho will know to allow the API calls made from that domain.

As the tokens are available on the browser itself, we recommend handling them with care.

When you use our client-side JS SDK, it automatically generates a new access token upon expiry.

3. Self Client Applications

When your application does not have a redirect URL or a UI, but performs only a backend job, and does not need user intervention, then you must choose this client type.

A self client is often used when the application and Zoho services are operated by the same entity, and you want to enable secure communication between them. For example, you have an internal reporting tool and integrate it with Zoho Analytics. In this case, both the tool and Zoho Analytics are operated by the same entity.

Similarly, consider that you have a legacy product management system and want to perform data sync between Zoho CRM and the system, then you must use the self client.

Here is a gist of what happens.

1. You register your app as self client in Zoho API Console.
   
2. You will get the client details such as ID and secret.
   
3. You provide the scopes required for your app to access CRM data.
   
4. You will receive the grant token.
   
5. Your app must then make API calls to Zoho Accounts to generate access and refresh tokens.
   
6. Your app can then use this access token to make API calls to Zoho CRM and use data.
   

You can refer to our older Kaizen post on this topic for more details.

Note that self client apps can also use any of our server-side SDKs. As already said, the SDK takes care of access and refresh token generation, refreshing the access token, and token storage.

4. Non-browser applications

This client type is for devices that do not have a user agent such a web browser. A TV, for instance.

Let us consider an example involving a smart TV application that integrates with Zoho ShowTime. In this scenario, the smart TV application acts as a non-browser client.

Here is how authentication is handled:

1. You must register your smart TV app in Zoho API Console with the type "Non-browser application".
   
2. Users install a dedicated Zoho ShowTime application on their smart TVs.
   
3. When users launch the Zoho ShowTime application on their smart TV, they are prompted to authenticate with their Zoho ShowTime account.
   
4. When they successfully authenticate, Zoho Accounts sends the grant token to your app, along with the user-code, device-code and verification URL,The user must go to this verification URL on a browser and enter the user-code to grant permission to the app.
   
5. Meanwhile, your app must poll the accounts server using the grant token to check if the token has been received.
   
6. When the user enters the user code, Zoho Accounts sends the access token to your app.
   
7. Your app can then use the access token to make API calls to Zoho. Your app must take care of token storage and renewals.
   

Here is the protocol flow. For more details, refer to this doc.

5. Mobile-based applications

You must use this client type when you have developed an app exclusively for mobile devices. The protocol flow is similar to server-based application where a browser session is required for the users to authenticate.

Similar to server-side apps, mobile apps also need to handle redirection, token generation and storage.

If you use any of our Mobile SDKs, the SDK itself handles token generation and storage.

We hope you found this post useful. Let us know your thoughts in the Comment section or write to us at support@zohocrm.com.

Cheers!

• Topic Participants

• Shylaja S

  

• Piyush Dwivedi

• Ishwarya SG

  

• Onur Gulay - Smile Center Turkey®

  

• Sunderjan Siddharth

  

• Sticky Posts

• Kaizen #197: Frequently Asked Questions on GraphQL APIs

  🎊 Nearing 200th Kaizen Post – We want to hear from you! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.

• Kaizen #198: Using Client Script for Custom Validation in Blueprint

  Nearing 200th Kaizen Post – 1 More to the Big Two-Oh-Oh! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.

• Celebrating 200 posts of Kaizen! Share your ideas for the milestone post

  Hello Developers, We launched the Kaizen series in 2019 to share helpful content to support your Zoho CRM development journey. Staying true to its spirit—Kaizen Series: Continuous Improvement for Developer Experience—we've shared everything from FAQs

• Kaizen #193: Creating different fields in Zoho CRM through API

  🎊 Nearing 200th Kaizen Post – We want to hear from you! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.

• Client Script | Update - Introducing Commands in Client Script!

  Have you ever wished you could trigger Client Script from contexts other than just the supported pages and events? Have you ever wanted to leverage the advantage of Client Script at your finger tip? Discover the power of Client Script - Commands! Commands

• Recent Topics

• Set File Upload fields as mandatory

  Currently the CRM for some reason lacks the ability to set a file upload field as mandatory So we have an issue We have a requirement that before a Deal stage is set as Deal is Won the member needs to upload a file Now for some weird reason in Zoho I

• Editing HTML in Zoho CRM Email Template

  I am trying to create a template within the CRM email option, but need to be able to use custom HTML. There does not seem to be a way to do so.

• Ability to CC on a mass email

  Ability to CC someone on a mass email.

• How to make attachments mandatory

  I want the user to be unable to mark an opportunity as Closed – Won if it doesn’t have any attachments. I’ve already tried client scripts and functions, but nothing worked.

• SLA Ticket Report

  From data to decisions: A deep dive into ticketing system reports Service level agreement (SLA) ticket reports in a help desk system are crucial for ensuring that services are delivered according to established commitments. They help maintain accountability

• Zoho Backstage - PCI Compliance / Web Security

  I have a couple of questions related to Backstage and payment processing.... 1. my purchasing division is not giving approval to use Backstage yet because of some security issues. In order for us to take payments via a payment gateway like Authorize.net

• Zoho Tables August 2025 Update: Faster and Smoother

  We’ve been working behind the scenes to make Zoho Tables faster, lighter, and more reliable. Here are the highlights: Faster Response Times Optimised the way responses are generated. Reduced memory consumption by 20–25%, leading to smoother performance

• Video Upload from app says "unsupported aspect ratio" but is verified to be correct.

  I and my social media person are experiencing a problem where Social will not accept video uploads to Instagram. The error we receive is "unsupported aspect ratio" but looking directly at the file in question we see that the width and ratio both match

• Disposable Email Addresses

  Dear zMail Team, Can you also bring out a few disposable email addresses for each accounts? That way occasional registrations and imminent spam from them can be largely solved right? ---- Deepak Vasudevan http://thamizhththendral.blogspot.com/

• Zoho sheet - Zoho expense

  I want to schedule to create an expense using Zoho Sheet and flow. That is the EMI that I pay on a particular date to the bank and should be itemised, like principal and interest on the loan. Can someone help me in this regard??

• Ability to configure a schedule/shift for each user and/or crew in Zoho FSM

  Hello, In our team of Field Agents, we have different shifts. Some field agent always work from 7:00 AM to 4:00 PM while others work the evening shift like 4:00 PM to 11:00 PM. Sometime shift are on weekdays only or on weekend. It would be great to be

• Free webinar: Streamlining customer service paperwork with the Zoho Sign extension for Zoho Desk

  Hello Everyone! Have you been wondering about bridging the gap between digitised customer service and business paperwork? Join our free webinar to learn how you can do this by connecting Zoho Sign, our digital signature app, with Zoho Desk, our online

• Zoho Books | Product updates | July 2025

  Hello users, We’ve rolled out new features and enhancements in Zoho Books. From plan-based trials to the option to mark PDF templates as inactive, explore the updates designed to enhance your bookkeeping experience. Introducing Plan Based Trials in Zoho

• Mail Search should allow grouping by conversation like Gmail.

  Having switched from gmail I have found the search function hard to use. Mostly because mail is not grouped by conversation in search. If I search for a word when looking for a conversation had with someone then sometimes 10 emails will come up from the

• Improve Zoho Learn updated article notifications

  I noticed today while updating an article, that the notification users get says "[User Name] has published article [Article Name]..." My feedback to the product team is that it would be really helpful for an end user, if the system notification differentiated

• Safari Support

  Safari, the world's second largest browser, zoho desk does not officially or fully support. That needs to change.

• Can I get images from an "Image Upload" field in a webhook?

  I want to send images from 2 "image upload" fields via a webhook. Is this possible?

• Ticket closure notification - all contacts cc'd on email thread

  Hello, If a client sends an email to our service desk and cc's in other people that work at the same company - so that they are in the loop of the service request. When the we close the ticket, only the ticket owner (person who emailed us - which created

• Inactive account cleanup policy for Zoho Sign

  Zoho Sign reserves the right to delete accounts that are license free and inactive for more than 120 days. The account deletion will be initiated only after the user receives prior email notice about possible data deletion and how to backup the data.

• Missde API documentation for Sales Receipt

  Hi! I noticed that the Sales Receipt endpoint is not currently listed in your API documentation (https://www.zoho.com/books/api/v3/introduction/). Could you please provide any available temporary documentation for this endpoint, along with a detailed

• Multi-currency in Zoho CRM Forecast and Reports

  As a company we have branches in 4 different countries with as many different currencies. Our Sales Teams would like to work with their local currency as much as possible. The Forecast module using only 1 currency is practically usable only by the sales

• How to select from pricebook when creating a salesorder or quote

  I am creating a sales order and when selecting the Products I do not see any where to select from pricebooks. How do i associate this to my orders?

• Proposal for Creating a Unique "Address" Entity in Zoho FSM

  The "Address" entity is one of the most critical components for a service-oriented company. While homeowners may change and servicing companies may vary, the address itself remains constant. This constancy is essential for subsequent services, as it provides

• I cannot find my older documents from 2024 and 2023

  I cannot find my older documents from 2024 and 2023.

• System default SLA descriptions can't be modified

  The system default SLAs have identical descriptions for all SLA levels, but their settings differ. However, I am facing an issue where I cannot modify these descriptions and save the changes. The content of the description box can be edited but the changes

• Customising Help Center

  Hi I don't think it is possible to add custom pages to help center? We'd like to use this as a customer portal with support tickets, FAQ/Guides, Billing and contracts. Is there any plans to add a feature like this or an alternative way to do it other

• Replies sometimes creating separate ticket

  Sometimes when a customer responds to an email coming from Zoho Desk, instead of adding a reply to the original ticket, a separate ticket is created. This happens even though the response subject line contained the ticket number, and the person responding

• Ticket Approvals - External Users

  The ticket approval option - we need to be able to select external users (Contacts) for approvals. Sometimes we are working with an end user and their boss needs to approve a purchase. For example, working with a cashier on a broken cash register and

• Force Users to Ask Answer Bot a question... First

  End users will always skip talking to a bot. It would be nice if Zoho adopted the standard and forced users to first ask a question to answer bot (or zia in some fashion) and then pass to the agent if it wasn't answered. Options to force the user to speak

• View Answer Bot conversations?

  We are trialing Zia and are experimenting with Answer Bot on our knowledge base. So far so good! Management asks me if it is possible to view Answer Bot conversations, the purpose being to look over its shoulder and confirm that it is working as des

• Mass Email an Account

  It would be nice to mass email an account stating there is an outage at their business or something specific to an account is needed to be mass communicated. Even if it makes a ticket for every Email Out to every contact in the Account. Think: the customer

• Multiple Topics assigned to a single Campaign

  Hello, is it possible to assign multiple Topics to a single Campaign? We frequently write a content to our subscribers that spans multiple Topics and we would like to send it to all Contacts that are subscribed to at least one of the Topics. But it looks

• Zoho Projects Fonts and Accessibility missing

  I cannot find any more the tab where I can change the font in Zoho Project. I also checked the knowledgebase and there they have accessibility tab which I am completely missing. Is there some setup I am missing or is it a problem with our account?

• Zoho Books Custom Widgets Deprecation Error

  I created a simple sample widget with zet and published it using sigma Both in the Sandbox and Production the Widgets are showing this error

• Problems with PDF files in notebook

  I'm evaluating Zoho Notebook as an alternative to Evernote and imported my Evernote account to Zoho Notebook. First issue is that notes in Evernote that comprise a PDF are turned into a 'group' with a single note page (that has the text from the Evernote

• API (v3) Tasks sorting issue

  We are using the v3 API for Projects. When we gat all tasks, per page of 100 tasks, we get the task info alright. But when we try to sort based on DESC(last_modified_time) we don't get the correct sort order. It is roughly sorted by the last_modified_time,

• Assemblies make my stock go negative

  I am sure this is just the way that we are using this feature, but we use assemblies, a lot. The issue for us is the way that the relive inventory and the fact that it makes our composite item stock go negative. I have added flows to auto assemble and

• User Activity Reports

  I'd like to get data related to user activity.  For example, Login and logout times, emails sent/received, new records created , etc. Is that currently available. I just can't seem to find anything . Thanks, Dave

• Help: Populate “Contact Owner” details into Customer custom fields (for email templates) in Zoho Books

  We want to send invoices on behalf of our sales agents, and include the agent’s name, email, and phone in the email body using placeholders. Plan is to copy the Customer Owner details into three Customer custom fields, so they can be used as placeholders

• Undocumented Books API error message - 1000 - The requested action could not be completed. Please try again. | Unexpected error

  This code sometimes throws this error 1000 - The requested action could not be completed. Please try again. | Unexpected error What does it mean? result = zoho.books.updateRecord("salesorders",organization.get("organization_id"),salesorder_id,sales_

• Next Page