1. Registering a client
   
2. Generating the authorization code (grant token)
   
   a. For web-based applications
   
   b. For self client applications
   
3. Generating access and refresh tokens from the grant token
   

You can register a client in Zoho Developer Console either as a web application or a self client as displayed in the below image.

Error	Reason	Resolution
Enter a valid client name	The client name has a special character.	The client name must not contain any special characters except "_" and "&".
Enter a valid JavaScript Domain URI	The JavaScript domain is incorrect.	Specify valid JavaScript domains, separated by commas, and they must start with 'http'.
Enter a valid redirect URI	The redirect URI is incorrect.	Specify a valid redirect URI in the format "https://www.your-domain.com/callback".
Enter a valid homepage URL	The homepage URL is invalid.	Specify a valid homepage URL in the format "https://www.yourdomain.com".

The following images will give you an idea of these errors.

1. The web application redirects the user to the Zoho OAuth server with the required scope in the Accounts URL.
   "https://accounts.zoho.com/oauth/v2/auth?scope=ZohoCRM.users.ALL&client_id={client_id}&response_type=code&access_type={"offline"or"online"}&redirect_uri={redirect_uri}".
2. As you can see, the request URL has the parameters "scope", "response_type", and "redirect_uri".
   
3. The user sees the authorization prompt and approves the app's request as shown in the below image.
   
   
   
4. The user is redirected back to the application with an authorization code in the query string.
   
   
   
5. The application exchanges the authorization code for an access token.
   

1. Make a POST API call with the URL "{{accounts-domain}}/oauth/v2/token".
   
2. In the request body, pass the values of the following parameters.
   
   a. client_id
   
   b. client_secret
   
   c. redirect_uri
   
   d. code(this is the generated grant token)
   
   e. grant_type
   

Points to note

1. For redirection-based authorization, the grant token is valid only for a minute.
   
2. For self client apps, the grant token is valid for the time you selected while authorizing your application.
   
3. If the generation of access and refresh tokens from the grant token fails, the grant token becomes invalidated. You must generate another grant token.
   
4. You can generate a grant token only up to five times in a minute.
   
5. The access token is valid only for an hour. You must use the refresh token to generate new access tokens.
   
6. The refresh token does not expire. It is invalidated only when you revoke the refresh token.
   
7. Each user in an organization can have a maximum of 20 refresh tokens. Also, each refresh token can have a maximum of 30 active access tokens.
   
8. When a user creates the 31st access token, the system deletes the first created access token. Similarly, when the user creates the 21st refresh token, the system deletes the first created refresh token.