Kaizen #79 - OAuth2.0 - A Recap and FAQs

Kaizen #79 - OAuth2.0 - A Recap and FAQs

Hello everyone!
Welcome to another week of Kaizen!
Today, we will address a few frequently-asked questions about OAuth2.0 that include token generation, scopes, errors etc,.
If you have any other questions, let us know in the comment section. We will offer solutions and add them to this list.
Before we move on to common errors and their solutions, let us look at generating grant, access and refresh tokens for a client.

1. Creating a client

You must register your client on the API console to request access to users' resources. This client must handle authenticating itself to the authorization server and requesting an access token to access the users' resources.
Here is an example for creating a client for a server-based application.


2. Setting up an environment in Postman

  1. On the sidebar, click Environments > + icon.
  2. Enter a name for your environment.
  3. Create the following variables. We will fill in their values as we go along.
    ->client-id (obtained after registering the client)
    ->client-secret     (obtained after registering the client)
    ->redirect-uri (    given at the time of registering the client)
    ->accounts-url
    ->access-token
    ->refresh-token
    ->api-domain
    ->expiry-time
  4. Select Save to save any environment variables you have added.


3. Generating the authorization code(grant token)

The authorization code flow is often used when the client is a web application running on a server. This flow uses a server-side redirect URI to receive the authorization code and adds a layer of security, rather than relying on a client-side redirect URI.

What do you need?

  • client ID - obtained after registering the client.
  • scopes - to get consent from the users to use their data. See the available scopes here.
  • response_type - the value "code" as we are requesting for an authorization code.
  • access_type - online or offline(to get a refresh token along with an access token, later).

What will you get?

  • code - a one-time grant token that you will use to generate access and refresh tokens.
  • accounts-server - the Zoho accounts URL that you will use to generate access and refresh tokens. This is the variable accounts-url in Postman.
  • location - the API domain from which you must make API calls to access data. This is the variable api-domain in Postman.
Tip:
If you do not have an application, yet, but want to test this flow, copy-paste the following URL in your browser with valid values for the various parameters. 
You will receive the grant token as a value to the key "code" in the redirect URL you specified while registering the client.

Here is a GIF of this process.


Self-client

Use this option if your application does not have a domain and a redirect URL.
You can also use this when your application is a standalone server-side application performing a back-end job like data sync.


4. Generating access and refresh tokens from the grant token

Access tokens allow the application to access user's data from the resource server. Each access token is valid for an hour, after which, you must use the refresh token to generate a new access token. 

Note
Each access token is bound to the scope you specified while generating the grant token, i.e, if the scope while generating the grant token was ZohoCRM.modules.READ, you can only get data from all the modules but not update, create, or delete.

What do you need to generate access and refresh tokens?

  • client_id - obtained while registering the client
  • client_secret - obtained while registering the client
  • redirect_uri - specified while registering the client
  • code - the grant token you generated in the previous step
  • grant_type - the value authorization_code

What will you get?

  • access token - the token to access users' data. Valid for an hour.
  • refresh token - the token to generate new access token for the same scope. Does not expire until it is revoked or till the 21st refresh token is created.
  • scope - the scope for which these tokens are generated for.
  • API domain - the domain to which you must make API calls to access data.
  • expiry time in seconds and milliseconds - the time after which the access token expires in seconds and milliseconds. You can use this data to programmatically refresh the access token before it expires for continued access to data.
Here is how it works.


Tip:
When you use our API collection, the request to generate access and refresh tokens comes with a script that automatically updates the values of variables in your environment.


FAQs

1. Validity

  • Grant token - Two minutes; one-time use only.
  • Access token - One hour.
  • Refresh token - does not expire until it is revoked or a 21st refresh token is created.

2. Token Limit

  • Grant token - Ten grant tokens in a span of ten minutes.
  • Access token - Ten access tokens in a span of ten minutes. When you generate the 11th token, the first-created one will be deleted, automatically.
  • Refresh token - Ten refresh tokens in a span of ten minutes. You can have a maximum of 20 refresh tokens. When you create a 21st refresh token, the first-created one will be deleted.
The following are a few common errors you may face while generating tokens.

Error
Cause
Solution
invalid_oauth_token
The access token is either invalid or has expired.
Use the right access token or generate a new one from the refresh token.
invalid_scope
The scope you have used is invalid. 
Refer to Scopes for the list of available scopes.
invalid_code
The authorization code(grant token) is invalid or has expired.
Grant token is valid only for two minutes. Use a grant token to generate access and refresh tokens within this time.
Generate a new grant token if you face this error.
invalid_redirect_uri
The redirect URI you have given in the API console is invalid.
Specify a valid redirect URI to be able to receive a grant token.
invalid_client
Either the client ID or client secret is invalid.
Specify valid client ID and secret while making authorization calls. The API console has the client ID and secret.
invalid_response_type
The value of the "response_type" key is invalid.
While generating access and refresh tokens from the grant token, the value of the "response_type" key must always be "code".

Multi-DC

Zoho CRM is hosted at multiple data centers to comply with the privacy and data protection laws of various countries.
So, if your application is in the US DC but wants to use the data of users in the EU DC, you must enable multi-DC while registering your client.

The various domains and their respective accounts URLs are:

How do you ascertain the domain?

When you generate the grant token, the parameter location gives you the DC that the data is located in.
Similarly, when you generate the access and refresh tokens, the key api_domain gives you the domain-specific API URL.
For example, if you want to get the data of leads from EU, the API URL must be https://www.zohoapis.eu/crm/v4/Leads

We hope you found this post useful. We will meet you next week with another interesting topic.

Let us know your questions in the comment section or write to us at support@zohocrm.com.

Cheers!
Shylaja

    Access your files securely from anywhere








                            Zoho Developer Community



                                Bootcamp
                                Community
                                Pricing
                                Webinars
                                What's New
                                Integrations
                                Contact Support
                                Contact Sales
                                  Zoho Survey Resources
                                    Features
                                    Survey Templates
                                    Integrations
                                    Community
                                    iOS Mobile Surveys
                                    Pricing
                                    Android Mobile Surveys
                                    Insurvey Blogs
                                    Insight Blogs
                                    Tips & Tricks





                                                Latest Feature Updates

                                                  • Desk Community Learning Series


                                                  • Digest


                                                  • Functions


                                                  • Meetups


                                                  • Kbase


                                                  • Resources


                                                  • Glossary


                                                  • Desk Marketplace


                                                  • MVP Corner


                                                  • Word of the Day


                                                  • Ask the Experts




                                                      Zoho SalesIQ Resources

                                                            • Sticky Posts

                                                            • Kaizen #222 - Client Script Support for Notes Related List

                                                              Hello everyone! Welcome to another week of Kaizen. The final Kaizen post of the year 2025 is here! With the new Client Script support for the Notes Related List, you can validate, enrich, and manage notes across modules. In this post, we’ll explore how

                                                            • Kaizen #217 - Actions APIs : Tasks

                                                              Welcome to another week of Kaizen! In last week's post we discussed Email Notifications APIs which act as the link between your Workflow automations and you. We have discussed how Zylker Cloud Services uses Email Notifications API in their custom dashboard.

                                                            • Kaizen #216 - Actions APIs : Email Notifications

                                                              Welcome to another week of Kaizen! For the last three weeks, we have been discussing Zylker's workflows. We successfully updated a dormant workflow, built a new one from the ground up and more. But our work is not finished—these automated processes are

                                                            • Kaizen #152 - Client Script Support for the new Canvas Record Forms

                                                              Hello everyone! Have you ever wanted to trigger actions on click of a canvas button, icon, or text mandatory forms in Create/Edit and Clone Pages? Have you ever wanted to control how elements behave on the new Canvas Record Forms? This can be achieved

                                                            • Kaizen #142: How to Navigate to Another Page in Zoho CRM using Client Script

                                                              Hello everyone! Welcome back to another exciting Kaizen post. In this post, let us see how you can you navigate to different Pages using Client Script. In this Kaizen post, Need to Navigate to different Pages Client Script ZDKs related to navigation A.


                                                            Manage your brands on social media
                                                            Access Zoho Social

                                                              Zoho Pagesense Resources


                                                                  Zoho TeamInbox Resources

                                                                    Zoho DataPrep Resources


                                                                      Zoho CRM Plus Resources

                                                                        Zoho Books Resources


                                                                          Zoho Subscriptions Resources

                                                                            Zoho Projects Resources


                                                                              Zoho Sprints Resources


                                                                                Qntrl Resources


                                                                                  Zoho Creator Resources



                                                                                      Zoho CRM Resources

                                                                                      • CRM Community Learning Series

                                                                                        CRM Community Learning Series


                                                                                      • Kaizen

                                                                                        Kaizen

                                                                                      • Functions

                                                                                        Functions

                                                                                      • Meetups

                                                                                        Meetups

                                                                                      • Kbase

                                                                                        Kbase

                                                                                      • Resources

                                                                                        Resources

                                                                                      • Digest

                                                                                        Digest

                                                                                      • CRM Marketplace

                                                                                        CRM Marketplace

                                                                                      • MVP Corner

                                                                                        MVP Corner









                                                                                          Design. Discuss. Deliver.

                                                                                          Create visually engaging stories with Zoho Show.

                                                                                          Get Started Now


                                                                                            Zoho Show Resources

                                                                                              Zoho Writer

                                                                                              Get Started. Write Away!

                                                                                              Writer is a powerful online word processor, designed for collaborative work.

                                                                                                Zoho CRM コンテンツ



                                                                                                  Nederlandse Hulpbronnen


                                                                                                      ご検討中の方




                                                                                                              • Recent Topics

                                                                                                              • Is there a plan to allow for the hierarchical organization of Customers / Companies in Zoho Billing?

                                                                                                                We have a few customers who have organizational structures that we haven't quite found a way to deal with in Zoho Billing. In CRM, these sub-companies (or subsidiaries or whatever you want to call them) all have another CRM account as the parent account.

                                                                                                              • 【Zoho CRM】作業リスト機能リリースのお知らせ

                                                                                                                ユーザーの皆さま、こんにちは。コミュニティチームの藤澤です。 今回は「Zoho CRM アップデート情報」の中から、作業リスト機能リリースのお知らせ情報をご紹介します。 目次 作業リスト機能　概要 機能①　自分の未完了の活動 機能②　処理待ち 機能③　自分の作業リスト 作業リスト機能　概要 営業チームでは、CRM内に業務やデータが分散しているため、管理が煩雑になりがちです。この断片化は、機会の見逃しや生産性の低下につながります。 作業リスト機能は、タブを横断する業務項目をひとつのカスタマイズ可能なダッシュボードに集約し、業務を効率的に管理できるようにします。

                                                                                                              • SalesIQとPageSenseの利用について

                                                                                                                初めての投稿で場違いだったらすいません。 弊社ではSalesIQを運用しているのですが、追加でPageSenseの導入もしたいと現場からの声があります。 両サービスともクッキー同意バナーが必要なサービスなのですが 弊社では同意無しに情報はとりませんという方針なので 2つ入れると2つバナーを出す必要がでてきます・・・ 両サービスを運用されてる方があれば運用状況とか教えてほしいです。 PageSenseについては詳細まで機能を理解してないなかでの質問です。

                                                                                                              • Zohomail - The "All Messages" vs "In Box"

                                                                                                                Why do some new email message appear under the all messages view but not in my inbox? That's really annoying but to be fair I've experienced the same with gmail.

                                                                                                              • Parent-Child Tickets using API or Deluge

                                                                                                                Hi Everyone, We are looking at the parent-child ticketing features in Zoho Desk. We want to be able to create a parent ticket at customer level and nest child tickets underneath. The issue we are facing is to be able to automate this. I'm checking the

                                                                                                              • Closing connected ticket after closing WA conversation

                                                                                                                Hi, At the moment, once someone sends a message to our WA number, a corresponding ticket is automatically created. After the question is answered, our support department closes the chat/conversation. However, after that, the connected ticket is still

                                                                                                              • Note sync turn off

                                                                                                                Hi, Is it possible to turn off notes sync between task notes and the parent module? (Account/Deal)

                                                                                                              • Basic Plan Active but Survey Creation Still Limited to 3 Surveys

                                                                                                                I have an active Basic (Monthly) subscription (valid period: Dec 24, 2025 – Jan 24, 2026), but the system still limits survey creation to only 3 surveys, which matches Free plan behavior. The subscription appears active in Portal Information, however

                                                                                                              • 2025 in Review: Powering Field Services Forward—One Feature at a Time

                                                                                                                As 2025 draws to a close, it’s time to pause and reflect on a year of meaningful progress at Zoho FSM. This year was all about listening closely to our customers and partners, building with purpose, and continuously improving the way field service teams

                                                                                                              • Syncing with Google calendar, Tasks and Events

                                                                                                                Is it possible to sync Zoho CRM calendar, task and events with Google Calendar's tasks and events. With the increasing adoption by many major tool suppliers to sync seamlessly with Google's offerings (for instance I use the excellent Any.do task planning

                                                                                                              • CRM x WorkDrive: We're rolling out the WorkDrive-powered file storage experience for existing users

                                                                                                                Release plan: Gradual rollout to customers without file storage add-ons, in this order: 1. Standalone CRM 2. CRM Plus and Zoho One DCs: All | Editions: All Available now for: - Standalone CRM accounts in Free and Standard editions without file storage

                                                                                                              • FOLDER DISAPPEARED

                                                                                                                Hello Zoho Community. I recently found a problem with no explanation: a folder in Zoho Analytics just disappeared, but the tables and SQL sentences still existed, the folder was not deleted. The solution for me in this case was to create a new folder,

                                                                                                              • New to automation - please help

                                                                                                                Hi there! We are new to automations in Zoho. We built out one automation campaign and it seems to be firing off for some people but others not. Please advise what's the best practice or if anything we should tweak. Thank you so much!

                                                                                                              • Unable to Create Zoho Booking via the Book Appointment API

                                                                                                                Its giving the below error {     "response": {         "errormessage": "Error setting value for the variable:customer_details\n null",         "status": "Error"     } } Request: POST Url: https://www.zohoapis.in/bookings/v1/json/appointment attached Zoho-oauthtoken

                                                                                                              • Task Details on task template

                                                                                                                When creating a task template in settings that task details seem to be missing. Is it not possible to set the details of a task, such as the priority, type, reminder settings, and custom field values?

                                                                                                              • Building Toppings #3 -Testing and publishing Bigin toppings

                                                                                                                Hey Biginners! In previous forum posts, we discussed what a Bigin topping is and explored the Bigin Developer Console's features. In this post, we're going to create a topping from scratch and discuss how to test and publish it. Our topping will automate

                                                                                                              • markdown files?

                                                                                                                How can I import a markdown file into a note?

                                                                                                              • Mail to Zoho Notebook

                                                                                                                In the Instuctiosn I faound as email add@notebook.app In my account I see add@eu.notebook.app What is correct please

                                                                                                              • Auto-Invite Users to Portals in Zoho CRM based on Conditions

                                                                                                                Hello Everyone, You can now automate portal invitations in Zoho CRM with the new Auto-Invite users feature in Portal management. No more manually enabling portal access one by one. With this enhancement, you can automatically send invites for users to

                                                                                                              • Growth You can Count On: Zoho Billing's 2025 Journey

                                                                                                                As we wrap up 2025, we’re reflecting on a year rooted in steady progress and meaningful growth for Zoho Billing. Every enhancement we have introduced was built to support scalable and reliable billing growth for your business. From launching the Enterprise

                                                                                                              • Need help with creating workflow with Bigin and Clickup

                                                                                                                Can you please help me with this? I am trying to create a workflow in Zoho Flow wherein a bigin Pipeline deal moves to Decision Closing, it will create a task and subtasks in Clickup, under the condition/filter that the Deal name contains the word Social

                                                                                                              • [Webinar] Automate generation of wills, trusts, POAs, and other estate planning documents with Zoho Writer

                                                                                                                Managing the lifecycle of the estate planning documents such as wills, trusts, and POAs, from client intake to final storage, can be complex and time-consuming. Join our live webinar to learn how Zoho Writer transforms this process by automating document

                                                                                                              • Create / Update Rule in TeamInbox when record is updated in ZohoCRM using flow?

                                                                                                                I'm currently evaluating options and trying to work out if the possible scenario is possible; If a record in ZohoCRM is updated, take 2 of the fields from that - lets call them 'OrderRef' and 'OrderTo'. Using flow, if a record is added or updated, add

                                                                                                              • Plans to allow more columns of monitoring, and monitoring not only your own channels?

                                                                                                                Are their any plans to allow more columns of monitoring, and monitoring not only your own channels? Here's why - I'm sure I'm not alone in that we sell other brands products, so not only am I interested in my own brand social channels, but also the social

                                                                                                              • Unwrapping the best practices for the Zoho Desk mobile app: Part 1

                                                                                                                In focus: Empowering the field and frontline customer support representatives Imagine having to carry your computer everywhere to respond to customers, handle escalations, and update your process. This series presents you with efficient tips to handle

                                                                                                              • dealing with post dated cheques

                                                                                                                Hi, can you help me please the best way to deal with this We sell an item of three months duration that is paid for with post dated cheques in monthly stages example - item is sold £3000 Cheque 1 is for £1000 due at time of sale (say Sept) cheque 2 is dated 25th of next month (Oct) cheque 3 is dated 25th of next month +1 (Nov) Now, with invoice number one it's simple - i send a standard invoice as usual But with the other two here's what i want zoho to do next month i want it to send an invoice on

                                                                                                              • Is there a way to sell in a practical method multiple subscriptions of the same product? i.e. domain names

                                                                                                                In evaluating Zoho Billing, a hurdle to adopting it is that Zoho Billing does not seem designed to support businesses that sell multiple subscriptions of the same product. In our case, we need to sell and manage several domain names per client. Am I right

                                                                                                              • Paid Support Plans with Automated Billing

                                                                                                                We (like many others, I'm sure) are designing or have paid support plans. Our design involves a given number of support hours in each plan. Here are my questions: 1) Are there any plans to add time-based plans in the Zoho Desk Support Plans feature? The

                                                                                                              • Bug Report: "Name A-Z" sorting fails when Note titles start with an Emoji

                                                                                                                Hello, I recently migrated from Evernote (~2600 notes across 23 notebooks). I use emojis at the start of my note titles for visual organization. The Issue: When I set the view to Sort by: Name (A to Z), the sorting logic breaks for any note starting with

                                                                                                              • Copy & Paste not working

                                                                                                                I could create and save 10 new documents but when I go to copy and paste content (just text) into them, only 1 of 10 would save the content. It would appear to save the content but when I go back into the documents, they are empty.

                                                                                                              • editing/applying online payments

                                                                                                                We have customers who pay part or all of an invoice and then cancel their service and want the payment as a credit to future work. It would be ideal if we could make it an excess payment and then void the invoice. I can't make it an excess payment because

                                                                                                              • Contacts per department

                                                                                                                Hello, Is it possible to limit Contacts to a Department? Thanks

                                                                                                              • This site can’t be reached mail.zoho.com took too long to respond

                                                                                                                In my office at any system, we couldnt able to login zoho email. it shows " This site can’t be reached mail.zoho.com took too long to respond". please fix it soon.

                                                                                                              • Can send email from zoho mail, but can't receive any.

                                                                                                                Hi, My domain is sattvameditationresort.com. I've updated MX records with those of Zoho. But i can't send any mails to this email id from gmail. I have checked the MX status with MXTOOLS, its showing the correct entry either. The error is as shown below:

                                                                                                              • My domain did not activate

                                                                                                                Hi, my domain (apsaindustrial.com.ar) did not activate, and the phone verification message never arrived. Please would you solve this problem? Thanks.

                                                                                                              • Host not found?

                                                                                                                Howdy! So i'm trying to add my custom domain for with the mail server. I have 100% control of my DNS and have tried every single option (TXT, CNAME, and even HTML) multiple times, ensuring i did it properly, to no luck. I get the same error message every

                                                                                                              • Emails are going to notification folder and not in inbox

                                                                                                                emails are going to notification folder and not into inbox

                                                                                                              • Error AS101 when adding new email alias

                                                                                                                Hi, I am trying to add apple@(mydomain).com The error AS101 is shown while I try to add the alias.

                                                                                                              • Report on opportunities showing only the last note added.

                                                                                                                Hi I need to create a report that shows the most recent note added to each opportunity. This is so management can see what the latest update is according to the assigned salesperson. One workaround is to use the status field but this implies added manual work and mistakes as the salesperson would have to copy the existing status to a note before adding the latest status... otherwise the activity history would be lost. My current workaround is a report on Notes with Opportunities as the related module.

                                                                                                              • Please add Zelle as an online payment option

                                                                                                                Hello, I would like to request Zelle be added to the online payment service providers for Zoho Invoice. Considering how ubiquitous Zelle has become as a way to pay people via the major banking institutions, I feel like many freelancers would benefit from

                                                                                                              • Next Page