Kaizen #79 - OAuth2.0 - A Recap and FAQs

Hello everyone!

Welcome to another week of Kaizen!

Today, we will address a few frequently-asked questions about OAuth2.0 that include token generation, scopes, errors etc,.

If you have any other questions, let us know in the comment section. We will offer solutions and add them to this list.

Before we move on to common errors and their solutions, let us look at generating grant, access and refresh tokens for a client.

1. Creating a client

You must register your client on the API console to request access to users' resources. This client must handle authenticating itself to the authorization server and requesting an access token to access the users' resources.

Here is an example for creating a client for a server-based application.

2. Setting up an environment in Postman

On the sidebar, click Environments > + icon.
Enter a name for your environment.
Create the following variables. We will fill in their values as we go along.
->client-id (obtained after registering the client)
->client-secret (obtained after registering the client)
->redirect-uri (given at the time of registering the client)
->accounts-url
->access-token
->refresh-token
->api-domain
->expiry-time
Select Save to save any environment variables you have added.

3. Generating the authorization code(grant token)

The authorization code flow is often used when the client is a web application running on a server. This flow uses a server-side redirect URI to receive the authorization code and adds a layer of security, rather than relying on a client-side redirect URI.

What do you need?

client ID - obtained after registering the client.
scopes - to get consent from the users to use their data. See the available scopes here.
response_type - the value "code" as we are requesting for an authorization code.
access_type - online or offline(to get a refresh token along with an access token, later).

What will you get?

code - a one-time grant token that you will use to generate access and refresh tokens.
accounts-server - the Zoho accounts URL that you will use to generate access and refresh tokens. This is the variable accounts-url in Postman.
location - the API domain from which you must make API calls to access data. This is the variable api-domain in Postman.

Tip:

If you do not have an application, yet, but want to test this flow, copy-paste the following URL in your browser with valid values for the various parameters.

You will receive the grant token as a value to the key "code" in the redirect URL you specified while registering the client.

https://accounts.zoho.com/oauth/v2/auth?scope=scope_here&client_id=client_ID_here&response_type=code&access_type=offline&redirect_uri=redirect_uri&prompt=consent

Here is a GIF of this process.

Self-client

Use this option if your application does not have a domain and a redirect URL.

You can also use this when your application is a standalone server-side application performing a back-end job like data sync.

4. Generating access and refresh tokens from the grant token

Access tokens allow the application to access user's data from the resource server. Each access token is valid for an hour, after which, you must use the refresh token to generate a new access token.

Note

Each access token is bound to the scope you specified while generating the grant token, i.e, if the scope while generating the grant token was ZohoCRM.modules.READ, you can only get data from all the modules but not update, create, or delete.

What do you need to generate access and refresh tokens?

client_id - obtained while registering the client
client_secret - obtained while registering the client
redirect_uri - specified while registering the client
code - the grant token you generated in the previous step
grant_type - the value authorization_code

What will you get?

access token - the token to access users' data. Valid for an hour.
refresh token - the token to generate new access token for the same scope. Does not expire until it is revoked or till the 21st refresh token is created.
scope - the scope for which these tokens are generated for.
API domain - the domain to which you must make API calls to access data.
expiry time in seconds and milliseconds - the time after which the access token expires in seconds and milliseconds. You can use this data to programmatically refresh the access token before it expires for continued access to data.

Here is how it works.

Tip:

When you use our API collection, the request to generate access and refresh tokens comes with a script that automatically updates the values of variables in your environment.

FAQs

1. Validity

Grant token - Two minutes; one-time use only.
Access token - One hour.
Refresh token - does not expire until it is revoked or a 21st refresh token is created.

2. Token Limit

Grant token - Ten grant tokens in a span of ten minutes.
Access token - Ten access tokens in a span of ten minutes. When you generate the 11th token, the first-created one will be deleted, automatically.
Refresh token - Ten refresh tokens in a span of ten minutes. You can have a maximum of 20 refresh tokens. When you create a 21st refresh token, the first-created one will be deleted.

The following are a few common errors you may face while generating tokens.

Error	Cause	Solution
invalid_oauth_token	The access token is either invalid or has expired.	Use the right access token or generate a new one from the refresh token.
invalid_scope	The scope you have used is invalid.	Refer to Scopes for the list of available scopes.
invalid_code	The authorization code(grant token) is invalid or has expired.	Grant token is valid only for two minutes. Use a grant token to generate access and refresh tokens within this time. Generate a new grant token if you face this error.
invalid_redirect_uri	The redirect URI you have given in the API console is invalid.	Specify a valid redirect URI to be able to receive a grant token.
invalid_client	Either the client ID or client secret is invalid.	Specify valid client ID and secret while making authorization calls. The API console has the client ID and secret.
invalid_response_type	The value of the "response_type" key is invalid.	While generating access and refresh tokens from the grant token, the value of the "response_type" key must always be "code".

Multi-DC

Zoho CRM is hosted at multiple data centers to comply with the privacy and data protection laws of various countries.

So, if your application is in the US DC but wants to use the data of users in the EU DC, you must enable multi-DC while registering your client.

The various domains and their respective accounts URLs are:

How do you ascertain the domain?

When you generate the grant token, the parameter location gives you the DC that the data is located in.

Similarly, when you generate the access and refresh tokens, the key api_domain gives you the domain-specific API URL.

For example, if you want to get the data of leads from EU, the API URL must be https://www.zohoapis.eu/crm/v4/Leads

We hope you found this post useful. We will meet you next week with another interesting topic.

Let us know your questions in the comment section or write to us at support@zohocrm.com.

Cheers!

Shylaja

Access your files securely from anywhere

Zoho Developer Community

New to Zoho LandingPage?

Access Zoho LandingPage

Zoho LandingPage Resources

New to Zoho Survey?

Access Zoho Survey

Latest Feature Updates

Explore our Pricing & Plans

Zoho Survey Resources

Android Mobile Surveys

Insurvey Blogs

Insight Blogs

Tips & Tricks

New to Zoho CRM Plus?

Deliver unforgettable customer experiences

ACCESS ZOHO CRM PLUS

New to Zoho CRM Plus?

Deliver unforgettable customer experiences

ACCESS ZOHO CRM PLUS

New to Zoho Marketing Plus?

Everything you need to run your marketing

ACCESS ZOHO MARKETING PLUS

New to Zoho Marketing Plus?

Everything you need to run your marketing

ACCESS ZOHO MARKETING PLUS

New to Bigin?

Signup Now

Access Bigin

Latest Feature Updates

Zoho Desk Resources

Desk Community Learning Series
Digest
Functions
Meetups
Kbase
Resources
Glossary
Desk Marketplace
MVP Corner
Word of the Day

Tout forum

France ZUGs

Zoho SalesIQ Resources

Topic Participants
Shylaja S
David
Claire
Anu Abraham

Sticky Posts
Kaizen#162 : Add Tags and Open Pre-filled Email Drafts via Client Scripts
Hello everyone! Welcome to another informative Kaizen post. In this post, let us see how to accomplish the following using Client Script. 1. How to auto-tag a record based on field update? 2. How to Open a pre-filled email draft This post will provide
Client Script | Update - Introducing Commands in Client Script!
Have you ever wished you could trigger Client Script from contexts other than just the supported pages and events? Have you ever wanted to leverage the advantage of Client Script at your finger tip? Discover the power of Client Script - Commands! Commands
Extension Pointers - JS SDK series #4: Managing data from a widget using ZOHO.CRM.HTTP
Handling and managing the data between two applications is a major factor for an efficient business. There are a variety of ways to handle data between Zoho CRM and other third-party applications. You can use deluge CRM tasks, create connectors, use API
Kaizen #152 - Client Script Support for the new Canvas Record Forms
Hello everyone! Have you ever wanted to trigger actions on click of a canvas button, icon, or text mandatory forms in Create/Edit and Clone Pages? Have you ever wanted to control how elements behave on the new Canvas Record Forms? This can be achieved
Extension pointers for integrating Zoho CRM with Zoho products #8: Upload and manage Zoho Workdrive folders and files from within Zoho CRM
Keeping records on your customers and business prospects is essential for tracking data, conducting follow-ups, and running a business smoothly. When you use two separate applications, and store relevant data in each, checking and tracking data becomes