Kaizen #168 - Incremental Authorization
Welcome to this week's post in the Kaizen series. In this post, we will discuss Incremental Authorization.
What is Incremental Authorization?
Incremental Authorization is an OAuth strategy that allows a client to request specific authorization scopes as and when needed. This means that the client does not have to request every possible scope that might be needed upfront, which might result in a bad user experience. Incremental Authorization is considered a best practice in Oauth Authorization Request as:
- Users are not overloaded with scopes in the initial stage
- Users can control the amount of data they share
Who can use Incremental Authorization?
Server-based applications can make use of incremental authorization
Incremental Authorization Flow
Incremental Authorization FlowWhen a user first signs into the application, the application requests only the essential permissions needed. The user may trigger features that require additional permissions as they engage with the application. When the application identifies this, it follows the below steps:
Initiation Request (Step 1: Get Scope Enhancement Token )
The application makes a POST request to the endpoint /oauth/v2/token/scopeenhance, including the existing refresh token as a parameter. This request is aimed at obtaining a scope enhancement token, which is necessary for requesting additional permissions.
Scope Enhancement Request (Step 2)
After receiving the scope enhancement token, the app then makes a request to the endpoint /oauth/v2/token/addextrascope. In this request, it specifies which additional scopes are needed.
User Consent
The user is presented with a consent screen that details the new permissions being requested. This screen will only show the new permissions required and not those already granted.
If the user approves these new permissions, the refresh token (used in Step 1) and its associated access tokens will be updated to include the newly granted scopes.
Success Response
Upon successful approval by the user, a success response is returned, confirming that the additional scopes have been appended to the existing refresh token.
When is Incremental Authorization Useful?
Let us take a look at two scenarios where incremental authorization is particularly useful.
Scenario 1
Zylker Marketing, a marketing agency, utilizes a custom in-house marketing tool that integrates with Zoho CRM. Initially, the tool has permission to read Leads in Zoho CRM. However, as the marketing team expands their operations, they realize that they require to create new Contacts based on sign-ups and retrieve existing deals data for analysis. The tool is then revamped to create Contacts and view Deals data.
When a marketer who uses the tool tries to create a Contact for the first time, the incremental authorization method is called in the backend. The marketer is redirected to the Zoho login page. Once logged in, the marketer is prompted to give access to the new resources. This enhances the refresh token, and the tool can continue using the same refresh token.
Scenario 2
Consider that you want to use a new Zoho CRM API that just got released as part of the version release. Your refresh token does not have the required scope to access the new API. You can make use of incremental authorization to append the required scope to the same refresh token in these cases.
How can you use Incremental Authorization?
Step 1: Initiation Request
First, you need to send a request to get the scope enhancement token along with the refresh token for which the extra access is required.
Request format
POST {accounts-url}/oauth/v2/token/scopeenhance ?grant_type=update_scopes_token &client_id={client_id} &client_secret={client_secret} &refresh_token={refresh_token} |
The accounts-url is specific to the location (i.e., datacenter) where the client is registered. See all the server-specific URLs.
Request Parameters
You should send the initiation request with the below parameters. All parameters are mandatory
- grant_type: Specify the value as "update_scopes_token".
- client_id: Specify the client-id obtained from the API console.
- client_secret: Specify client-secret obtained from the API console.
- refresh_token: Specify the refresh token to which the additional scopes should be appended.
You will receive a response in the below format
{ "access_token": "{scope_enhancement_token}", "token_type": "update_scope", "expires_in": 600 } |
The scope_enhancement_token received in this response should be passed as a parameter in the next step - scope enhancement request.
Step 2: Scope enhancement request
This request appends the refresh token with additional scopes.
Request format
GET {accounts-url}/oauth/v2/token/addextrascope ?response_type=update_scopes &client_id={client_id} &redirect_uri={redirect_uri} &scope={required_scopes} &enhance_token={scope_enhancement_token} &logout=true |
Parameters
- response_type: Specify the value as "update_scopes".
- client_id: Specify the client-id obtained from the API console.
- redirect_uri : Specify the URI to which the authorization server will redirect the browser back with success or failure response. It has to be the same URI which is provided when registering the app in the API console.
- scope: Specify the scopes of the additional resources for which access is required.
- enhance_token: Scope enhancement token received in the response of the previous initiation request.
- logout: Specify as true if the user's session should be terminated after the permission is granted or rejected.
When this request is called, the application redirects the user to the Zoho Login page, and the user enters the Zoho credentials. Then, the permissions required are displayed once the user is authenticated.
The refresh token will be appended with the additional scopes, and a success response will be returned when the user grants permission. The user will be redirected to the redirect_uri with params status as success and scope_enhanced as true. The user can continue using the same refresh token can be used. If the user rejects the authentication, the system returns a failure response. The user will be redirected to the redirect_uri with params error as access_denied.
You will receive a response in the below formats:
Success Response
{redirect_uri}?status=success&scope_enhanced=true |
Failure Response
{redirect_uri}?error=access_denied |
We hope you found this post useful. We will meet you next week with another interesting topic!
If you have any questions, let us know in the comment section.
Cheers!
Previous Kaizen: Kaizen #167 - Configuration and Initialization of Zoho CRM Python SDK (V7) for different client types |
Kaizen Collection: Directory | Help document link: Incremental Authorization
Access your files securely from anywhere
Centralize Knowledge. Transform Learning.
All-in-one knowledge management and training platform for your employees and customers.
New to Zoho Recruit?
Zoho Developer Community
New to Zoho LandingPage?
Zoho LandingPage Resources
New to Zoho Survey?
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Bigin?
Topic Participants
Mable Mary M P
Sticky Posts
Kaizen #198: Using Client Script for Custom Validation in Blueprint
Nearing 200th Kaizen Post – 1 More to the Big Two-Oh-Oh! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.Kaizen #226: Using ZRC in Client Script
Hello everyone! Welcome to another week of Kaizen. In today's post, lets see what is ZRC (Zoho Request Client) and how we can use ZRC methods in Client Script to get inputs from a Salesperson and update the Lead status with a single button click. In thisKaizen #222 - Client Script Support for Notes Related List
Hello everyone! Welcome to another week of Kaizen. The final Kaizen post of the year 2025 is here! With the new Client Script support for the Notes Related List, you can validate, enrich, and manage notes across modules. In this post, we’ll explore howKaizen #217 - Actions APIs : Tasks
Welcome to another week of Kaizen! In last week's post we discussed Email Notifications APIs which act as the link between your Workflow automations and you. We have discussed how Zylker Cloud Services uses Email Notifications API in their custom dashboard.Kaizen #216 - Actions APIs : Email Notifications
Welcome to another week of Kaizen! For the last three weeks, we have been discussing Zylker's workflows. We successfully updated a dormant workflow, built a new one from the ground up and more. But our work is not finished—these automated processes are
New to Zoho TeamInbox?
Zoho TeamInbox Resources
Zoho CRM Plus Resources
Zoho Books Resources
Zoho Subscriptions Resources
Zoho Projects Resources
Zoho Sprints Resources
Qntrl Resources
Zoho Creator Resources
Zoho CRM Resources
Design. Discuss. Deliver.
Zoho Show Resources
Get Started. Write Away!
Writer is a powerful online word processor, designed for collaborative work.
Zoho CRM コンテンツ
-
オンラインヘルプ
-
Webセミナー
-
機能活用動画
-
よくある質問
-
Ebook
-
-
Zoho Campaigns
- Zoho サービスのWebセミナー
その他のサービス コンテンツ
Nederlandse Hulpbronnen
ご検討中の方
Recent Topics
mail did't send for particular email
mail did't send for particular emailGroup settings in Zoho Mail: Manage members, moderation, and spam controls for your organization's groups
When teams rely on group email addresses like team@org.com, hr@org.com, or sales@org.com, managing them without clear controls leads to unapproved senders, flooded inboxes, and no accountability over what gets delivered. Zoho Mail's Group settings inUpdate to Free plan attendee limit
Hi everyone! A quick update about Zoho Webinar's Free plan. We’ve adjusted the Free plan attendee limit from 100 to 20 attendees. Everything else in your Free plan stays the same; you'll continue to have access to all your existing features. If your webinarsPossibility to modify a standard wedget to create my own customized wedget
Below is the std wedget available for dashboard which is great to show the the overdue, current, and all tasks as well as issues for each team member. My problem is this; The list of users cannot be edited (there are admin users which are not relavantFeature Request: Include Creator-applicable Deluge updates in the Creator Release Notes
I'd like to put forward a suggestion about how Deluge updates are surfaced to Zoho Creator developers, and I'm hoping the Creator team will consider it. Zoho Creator is built on Deluge. Every workflow, custom function, validation and schedule we writeAdd home page or dashboard in CRM customer portal
is it possible to add home page or dashboard in CRM customer portal?Close task on Completion Date entry
This discussion is similar to my issue: "backdated-task-completion-date" discussion Scenario: A bunch of tasks have been completed. But, they have not been closed. Time goes by You finally get around to closing those tasks Projects assigns the date theIntroducing Color and Order Preferences for Blueprint Transitions
Blueprints exist to improve the efficiency of your company's processes and ensure compliance — but only if your users follow them promptly. More often than not, your users may find it challenging to adopt your processes and follow through on them, especiallyGroups and Moderation
Hi, I have set up a Group in my organisation but am having trouble with moderation. The members are a mix of addresses within the organisation and external emails addresses. The issue is how to set moderation to be off whenever any of the members sendsIntroducing Radio Buttons and Numeric Range Sliders in Zoho CRM
Release update: 1. 2 March 2026: Currently out for CN, JP, AU and CA DCs (Free and standard editions). For other DCs, this will be released by mid-March. 2. 26 March 2026: CA, SA, AU, JP, CN DCs - Free, Standard, Professional, Enterprise, Ultimate, CRMZoho CRM Sandbox now supports integrations
Hello everyone, We are now expanding Zoho CRM Sandbox to support integrations with other Zoho products. You can connect, configure, and validate the behavior of your integrated tools within a safe, isolated environment - testing end-to-end without touchingArchiving Contacts
How do I archive a list of contacts, or individual contacts?Introducing the New Zoho Assist Quick Support Plugin
We are thrilled to announce the new Zoho Assist Quick Support Plugin, the upgraded and enhanced version of the Zoho Assist Customer Plugin. This new plugin allows organizations and IT administrators to deploy it directly onto their customers’ devices,What's New - June 2026 | Zoho Backstage
Hello everyone! We’ve rolled out a new set of improvements across Zoho Backstage to help you manage events more efficiently and provide a better experience for your attendees. Take a look at what’s new in this month’s update. Assign attendees later andMore Zia AI capabilities are included across additional Zoho Desk editions
Hello everyone, We are expanding the availability of AI-powered features in Desk to the other paid subscriptions from 7th July 2026. Right now, the following AI-based features are available for Enterprise edition users: Intelligence: Sentiment analysis,Summer release '26 should be called Enterprise Summer Release '26
Summer release '26 should be called Enterprise Summer Release '26 because almost all updates or the more useful ones, are limited for Enterprise subscriptions. us with Basic or Premium susbcriptions are basically left in the cold.Previous conversation title on new messenger widget translation
The title of previous conversations title on the new messenger widget personalisation appears in english even when spanish is selected as default languageExport Tickets from the Help Center
Hello everyone! We are now allowing end users to export tickets directly from the help center. The ticket export allows users to: Filter tickets by Department, Priority, and Account before exporting. Download files from Export History (Setup > Data administrationAccount Duplication Control in Zoho CRM
The Goal Prevent users from creating duplicate Account records in Zoho CRM. Accounts should be sourced from ERP and synced into Zoho—no. Allow to create Accounts if they don't exist in our ERP. What I've Implemented removed Account creation permissionsError 1011 saving website personalisation — blocking all changes (corrupted "home_page.content" field)
When trying to save changes under Settings → Brands → MY COMPANY → Website → Personalisation → Messenger, I receive the following error: "Either the request parameters are invalid or absent" upon checking on the developer console of the browser I getCanvas View: Add font family selection (incl. Google Fonts / Hebrew & RTL fonts)
Hi Zoho CRM team, The Canvas design suite (List View, Tile View, Table View and Record Detail) currently allows customizing font weight, size, color, alignment and case - but there is no option to choose the font family. All text is rendered in the built-inThis user is not allowed to add in Zoho. Please contact support-as@zohocorp.com for further details
Hello, Just signed up to ZOHO on a friend's recommendation. Got the TXT part (verified my domain), but whenever I try to add ANY user, I get the error: This user is not allowed to add in Zoho. Please contact support-as@zohocorp.com for further details I have emailed as well and writing here as well because when I searched, I saw many people faced the same issue and instead of email, they got a faster response here. My domain is: raisingreaderspk . com Hope this can be resolved. Thank youIssue embedding image Zoho Books email signature
I am trying to embed my company logo to my email signature using the image url tool on the settings but I keep getting the following error: Enter a valid public image URL I am using a public link from either WorkDrive or OneDrive and I still get the sameE-Mail Distribution List
How do I create an e-mail distribution list in Zoho Mail?Tip #80- Secure Connect: Add an Extra Layer Before You Connect – 'Insider Insights'
Tip 80 – Secure Connect: Add an Extra Layer Before You Connect – 'Insider Insights' Hello Zoho Assist Community! Picture this: your support team relies on unattended access to keep the business running. Servers need overnight patches. Remote workstationsBusiness Whatsapp is not Showing
I’ve attached a screenshot from the Zoho CRM Android app when clicked the call button. It is showing Personal WhatsApp, which is not installed on the phone. Also, the installed WhatsApp Business account is not showing.How to access a unified inbox for more than one zoho accounts (using paid workplace services)
Hello, we are using zoho for a few months and also suggest your services, setting them up for our clients. Several from our clients, our company as well, use more than 1 email addresses. Using the web version, we are only able to add them as accountsModify a standard wedget to create my own customized wedget ?
Below is the std wedget available for dashboard which is great to show the the overdue, current, and all tasks as well as issues for each team member. My problem is this; The list of users cannot be edited (there are admin users which are not relavantAdvanced Formatted Resume Templates for Applications
Advanced Formatted Resume Templates can now be created and used directly from the Applications module, with support for application module fields. Until now, Advanced templates were limited to the Candidates module. That meant resumes generated from ApplicationsZoho Books | Product updates | July 2026
Hello users, We’re excited to bring you the latest updates in Zoho Books for July 2026! This month's release introduces Terminal Payments, CMP-08 filing for composition taxpayers, SEPA Credit Transfer support, the new Receipts and Payments Report forBoost your CRM communication with new font types, sizes, and default reply-to options while composing emails
Hello Everyone, We’re excited to introduce a series of impactful enhancements to the email composer settings in Zoho CRM. These updates enable you to personalize and optimize your customer interactions with greater efficiency. So what's new? Add customZoho CRM Community Digest - June 2026| Part 2
Hello Everyone! Welcome to the second half of our June Zoho CRM Community Digest! We are keeping the momentum going with powerful updates to filter out unnecessary email syncs, a revamped CRM Import tool, smarter follow-up updates in cadences, and ZiaMigrate from Zoho Mail to G Suite
I am unable to find any documentation on how one can migrate from Zoho Mail to another platform, like G Suite or Office 365. Please point me to the right documentation. Thank you.Zoho Desk Android app - Option to set an email template as default
Hello everyone! We have enhanced the Email Template section in our app by introducing the ability to set a template as default directly from the Zoho Desk Android app, making it easier to access your preferred template without repeated manual selection.Zoho Desk Android and iOS app update: Odia Language
Hello everyone! We have now brought in support to access the Zoho Desk app in Odia language. Please update the app to the latest version directly from the Play Store/ App Store or using the links below: Zoho Desk - Play Store Zoho Desk - App Store OnceHow to check Leads with no Task (open activity)
Hi everyone, I was wondering if there’s a way to view leads that don’t have any tasks assigned or open activities linked to them.How do I migrate from Office 365 to Zoho Mail?
Check out Advik Email Migration Wizard, this software is specially developed to move mailboxes from Office 365 to Zoho Webmail. In addition you can migrate from Gmail, Yahoo, Rediffmail and 80+ webmail servers to ZOHO MAIL. Isn't it amazing? This is an all in one email migration solution. Steps to export emails from Office 365 to Zoho Webmail are as follows; Run Advik Email Migration Tool in your system. Select Office 365 as source and enter its login credentials. Select mailbox folders and chooseBridging the gap between incident management and project delivery
As an organization, you can have structured backup plans to handle issues that arise during project execution. Despite best efforts, even efficient processes can fall into an escalation trap where a red flag travels up the tiers but no real action follows.Update on default settings for AI features in Cliq
Hello all, We'd like to provide clarity on a recent change to AI feature defaults in Cliq. As part of our regular review of AI features conducted in April 2026, we re-evaluated how these features are enabled by default. We've decided that the AI featuresAssociate Zoho Billing Invoices with multiple Zoho FSM Work Orders
Hello Latha, We are writing a custom Deluge automation script in Zoho FSM to handle monthly consolidated billing. The script successfully compiles line items from multiple completed Work Orders, interfaces with the Zoho Billing API, and generates a singleNext Page