Kaizen #79 - OAuth2.0 - A Recap and FAQs

Kaizen #79 - OAuth2.0 - A Recap and FAQs

Hello everyone!
Welcome to another week of Kaizen!
Today, we will address a few frequently-asked questions about OAuth2.0 that include token generation, scopes, errors etc,.
If you have any other questions, let us know in the comment section. We will offer solutions and add them to this list.
Before we move on to common errors and their solutions, let us look at generating grant, access and refresh tokens for a client.

1. Creating a client

You must register your client on the API console to request access to users' resources. This client must handle authenticating itself to the authorization server and requesting an access token to access the users' resources.
Here is an example for creating a client for a server-based application.


2. Setting up an environment in Postman

  1. On the sidebar, click Environments > + icon.
  2. Enter a name for your environment.
  3. Create the following variables. We will fill in their values as we go along.
    ->client-id (obtained after registering the client)
    ->client-secret     (obtained after registering the client)
    ->redirect-uri (    given at the time of registering the client)
    ->accounts-url
    ->access-token
    ->refresh-token
    ->api-domain
    ->expiry-time
  4. Select Save to save any environment variables you have added.


3. Generating the authorization code(grant token)

The authorization code flow is often used when the client is a web application running on a server. This flow uses a server-side redirect URI to receive the authorization code and adds a layer of security, rather than relying on a client-side redirect URI.

What do you need?

  • client ID - obtained after registering the client.
  • scopes - to get consent from the users to use their data. See the available scopes here.
  • response_type - the value "code" as we are requesting for an authorization code.
  • access_type - online or offline(to get a refresh token along with an access token, later).

What will you get?

  • code - a one-time grant token that you will use to generate access and refresh tokens.
  • accounts-server - the Zoho accounts URL that you will use to generate access and refresh tokens. This is the variable accounts-url in Postman.
  • location - the API domain from which you must make API calls to access data. This is the variable api-domain in Postman.
Tip:
If you do not have an application, yet, but want to test this flow, copy-paste the following URL in your browser with valid values for the various parameters. 
You will receive the grant token as a value to the key "code" in the redirect URL you specified while registering the client.

Here is a GIF of this process.


Self-client

Use this option if your application does not have a domain and a redirect URL.
You can also use this when your application is a standalone server-side application performing a back-end job like data sync.


4. Generating access and refresh tokens from the grant token

Access tokens allow the application to access user's data from the resource server. Each access token is valid for an hour, after which, you must use the refresh token to generate a new access token. 

Note
Each access token is bound to the scope you specified while generating the grant token, i.e, if the scope while generating the grant token was ZohoCRM.modules.READ, you can only get data from all the modules but not update, create, or delete.

What do you need to generate access and refresh tokens?

  • client_id - obtained while registering the client
  • client_secret - obtained while registering the client
  • redirect_uri - specified while registering the client
  • code - the grant token you generated in the previous step
  • grant_type - the value authorization_code

What will you get?

  • access token - the token to access users' data. Valid for an hour.
  • refresh token - the token to generate new access token for the same scope. Does not expire until it is revoked or till the 21st refresh token is created.
  • scope - the scope for which these tokens are generated for.
  • API domain - the domain to which you must make API calls to access data.
  • expiry time in seconds and milliseconds - the time after which the access token expires in seconds and milliseconds. You can use this data to programmatically refresh the access token before it expires for continued access to data.
Here is how it works.


Tip:
When you use our API collection, the request to generate access and refresh tokens comes with a script that automatically updates the values of variables in your environment.


FAQs

1. Validity

  • Grant token - Two minutes; one-time use only.
  • Access token - One hour.
  • Refresh token - does not expire until it is revoked or a 21st refresh token is created.

2. Token Limit

  • Grant token - Ten grant tokens in a span of ten minutes.
  • Access token - Ten access tokens in a span of ten minutes. When you generate the 11th token, the first-created one will be deleted, automatically.
  • Refresh token - Ten refresh tokens in a span of ten minutes. You can have a maximum of 20 refresh tokens. When you create a 21st refresh token, the first-created one will be deleted.
The following are a few common errors you may face while generating tokens.

Error
Cause
Solution
invalid_oauth_token
The access token is either invalid or has expired.
Use the right access token or generate a new one from the refresh token.
invalid_scope
The scope you have used is invalid. 
Refer to Scopes for the list of available scopes.
invalid_code
The authorization code(grant token) is invalid or has expired.
Grant token is valid only for two minutes. Use a grant token to generate access and refresh tokens within this time.
Generate a new grant token if you face this error.
invalid_redirect_uri
The redirect URI you have given in the API console is invalid.
Specify a valid redirect URI to be able to receive a grant token.
invalid_client
Either the client ID or client secret is invalid.
Specify valid client ID and secret while making authorization calls. The API console has the client ID and secret.
invalid_response_type
The value of the "response_type" key is invalid.
While generating access and refresh tokens from the grant token, the value of the "response_type" key must always be "code".

Multi-DC

Zoho CRM is hosted at multiple data centers to comply with the privacy and data protection laws of various countries.
So, if your application is in the US DC but wants to use the data of users in the EU DC, you must enable multi-DC while registering your client.

The various domains and their respective accounts URLs are:

How do you ascertain the domain?

When you generate the grant token, the parameter location gives you the DC that the data is located in.
Similarly, when you generate the access and refresh tokens, the key api_domain gives you the domain-specific API URL.
For example, if you want to get the data of leads from EU, the API URL must be https://www.zohoapis.eu/crm/v4/Leads

We hope you found this post useful. We will meet you next week with another interesting topic.

Let us know your questions in the comment section or write to us at support@zohocrm.com.

Cheers!
Shylaja

    Access your files securely from anywhere






                    Zoho Campaigns Resources




                          Zoho Developer Community



                              Bootcamp
                              Community
                              Pricing
                              Webinars
                              What's New
                              Integrations
                              Contact Support
                              Contact Sales
                                Zoho Survey Resources
                                  Features
                                  Survey Templates
                                  Integrations
                                  Community
                                  iOS Mobile Surveys
                                  Pricing
                                  Android Mobile Surveys
                                  Insurvey Blogs
                                  Insight Blogs
                                  Tips & Tricks





                                              Latest Feature Updates

                                                • Desk Community Learning Series


                                                • Digest


                                                • Functions


                                                • Meetups


                                                • Kbase


                                                • Resources


                                                • Glossary


                                                • Desk Marketplace


                                                • MVP Corner


                                                • Word of the Day


                                                • Ask the Experts




                                                    Zoho SalesIQ Resources


                                                          Manage your brands on social media
                                                          Access Zoho Social

                                                            Zoho Pagesense Resources


                                                                Zoho TeamInbox Resources

                                                                  Zoho DataPrep Resources


                                                                    Zoho CRM Plus Resources

                                                                      Zoho Books Resources


                                                                        Zoho Subscriptions Resources

                                                                          Zoho Projects Resources


                                                                            Zoho Sprints Resources


                                                                              Qntrl Resources


                                                                                Zoho Creator Resources



                                                                                    Zoho CRM Resources

                                                                                    • CRM Community Learning Series

                                                                                      CRM Community Learning Series


                                                                                    • Kaizen

                                                                                      Kaizen

                                                                                    • Functions

                                                                                      Functions

                                                                                    • Meetups

                                                                                      Meetups

                                                                                    • Kbase

                                                                                      Kbase

                                                                                    • Resources

                                                                                      Resources

                                                                                    • Digest

                                                                                      Digest

                                                                                    • CRM Marketplace

                                                                                      CRM Marketplace

                                                                                    • MVP Corner

                                                                                      MVP Corner







                                                                                        Design. Discuss. Deliver.

                                                                                        Create visually engaging stories with Zoho Show.

                                                                                        Get Started Now


                                                                                          Zoho Show Resources


                                                                                            Zoho Writer Writer

                                                                                            Get Started. Write Away!

                                                                                            Writer is a powerful online word processor, designed for collaborative work.

                                                                                              Zoho CRM コンテンツ



                                                                                                Nederlandse Hulpbronnen


                                                                                                    ご検討中の方




                                                                                                          • Recent Topics

                                                                                                          • Seamless multilingual messaging and tone control in Zia IM Composer

                                                                                                            Hello everyone! Managing customer conversations across multiple languages can be time-consuming. Using Zia in the Instant Messaging (IM) Composer helps you overcome this by providing tools to translate content, adjust your tone, and refine your messages

                                                                                                          • Advanced Deluge help needed with custom function and COQL limits

                                                                                                            I have a scheduled function that takes a snapshot of specific metrics and saves them to a custom module. However I'm struggling with the limits of COQL. I attach my full code, but an example of the issues I'm having is that it's erroring with a 'Limit

                                                                                                          • Tip of the Week - Conditional Formatting Chart

                                                                                                            Conditional formatting allows you to highlight your data series based on a pattern or a trend in your data. This makes it easy for you to identify when your data reaches certain values or when it deviates from the trend.  Zoho Analytics allows you to

                                                                                                          • Zoho Learn - AI Translate

                                                                                                            Hi Learn team, I had a situation today where I was providing training to a client team and I had written articles into their Zoho Learn to support their learning. I realised that one of the team members was a non-native English speaker and they were struggling

                                                                                                          • Payroll In Canada

                                                                                                            Hi, When can we expect to have payroll in Canada with books 

                                                                                                          • Power of Automation :: Auto-Sync Custom Date Field Between Related Tasks via Blueprint Transition

                                                                                                            Hello Everyone, A custom function is a software code that can be used to automate a process and this allows you to automate a notification, call a webhook, or perform logic immediately after a workflow rule is triggered. This feature helps to automate

                                                                                                          • Introducing auto-upgrade in Zoho LandingPage

                                                                                                            Hi everyone, We’re excited to share an upcoming update to help you get the most out of your landing pages — the auto-upgrade option, launching on October 22, 2025. Your landing pages are designed to bring in leads, and we want to make sure you never miss

                                                                                                          • Workdrive comment links stopped working.

                                                                                                            I have marked a PDF file with 95 comments, they have worked for a while. When i clicked on them they brought me to the correct page and showed me the outline that i had drew on the plans. The comments included the page number of the outline, but now it

                                                                                                          • How to Bulk-Update Sales Orders in CRM

                                                                                                            Hi - I need to bulk update existing sales orders with dates from our ERP of when the sales orders were created. I made a date field on the Sales Order module where I want to insert that data. I can't Mass Update because I am not updating the fields to

                                                                                                          • Zoho ToDo in Cliq

                                                                                                            Our organization utilizes Zoho ToDo in the Zoho Mail Desktop app. Is there a way for these to show up in Cliq Desktop app as well?

                                                                                                          • 【Zoho CRM】サンドボックス機能のアップデート：カスタムビューが利用可能になりました。

                                                                                                            ユーザーの皆さま、こんにちは。コミュニティチームの中野です。 今回は「Zoho CRM アップデート情報」の中から、サンドボックス機能のアップデートをご紹介します。 目次 1. カスタムビューとは 2. 今回の機能アップデートについて 1. カスタムビューとは カスタムビューは、ユーザーが設定した条件に基づいてデータをフィルタリング・整理し、 重要な情報へ効率的にアクセスできるようにする機能です。 「過去15日間の見込み客」や「受注間近の商談」、「特定の優先度レベルが設定された案件」など 条件を指定してわずか数クリックで設定できます。

                                                                                                          • Changing an agents email address

                                                                                                            How do you change an agent's email address? I keep getting a red circle even though I am an admin. And on one of my agents he has two email addresses? How is that possible?

                                                                                                          • Zoho CRM - Potentials Tab

                                                                                                            Hi! When I create a Deal (Potentials tab) the header looks like this: After a refresh on the page it looks like this: What should I do so that it is displayed like in the second pic without refresh? Also I have a user that as of recently, cannot see this

                                                                                                          • Is there a way to automatically add Secondary Contacts (CCs) when creating a new ticket for specific customers?

                                                                                                            Some of our customers want multiple contacts to receive all notifications from our support team. Is there a way to automatically add secondary contacts to a ticket when our support team opens a new ticket and associates it with an account? This would

                                                                                                          • Unable to create embed code for resource of workdrive using API

                                                                                                            Hello Team, I am trying to create embed code for a resource using workdrive api in powershell, however facing some issues with injecting data in body. Followed Doc: https://workdrive.zoho.com/apidocs/v1/filefoldersharing/shareeveryone Please help, below

                                                                                                          • Feature Request - Insert URL Links in Folders

                                                                                                            I would love to see the ability to create simple URL links with titles in WorkDrive. or perhaps a WorkDrive extension to allow it. Example use case: A team is working on a project and there is project folder in WordDrive. The team uses LucidChart to create

                                                                                                          • not able to convert pdf to jpg and other forms and vice versa.

                                                                                                            i want to change my pdf to jpg, word, etc and some times jpg to pdf. i don't know how to do in this.

                                                                                                          • Enable / show scroll bar when Mega Menu is opened

                                                                                                            Hey there I am using the mega menu add-on and experience a "flicker" whenever the mega menu opens. The reason is, that the scrollbar, which has a width of a few pixels, stops showing when the mega menu opens. As the scrollbar disappears the whole page

                                                                                                          • Shared Mailboxes Disappeared

                                                                                                            Zoho Mail users in our company haven't been able to see their Shared Mailboxes for the past few hours. I've checked with App and Web Access, but they can't access them. When I send emails to their addresses, I get no error messages. They're still visible

                                                                                                          • Reports: Custom Search Function Fields

                                                                                                            Hi Zoho, Hope you'll add this into your roadmap. Issue: For the past 2yrs our global team been complaining and was brought to our attention recently that it's a time consuming process looking/scrolling down. Use-case: This form is a service report with

                                                                                                          • Zoho Inventory - Composite Items - Assembly - Single Line Item Quantity of One

                                                                                                            Hi Zoho Inventory Team, Please consider relaxing the system rules which prevent an assembly items from consisting of a single line item and outputting a quantity of 1. A client I'm currently working with sells cosmetics and offers testers of their products

                                                                                                          • How can I transfer data from Production to Development environment?

                                                                                                            Hi, I am using Creator V6 and would like to bring all the data in production to the Development and Testing environments? Is there an easy way of doing that or I have to export and import each table?

                                                                                                          • Add "Reset MFA" Option for Zoho Creator Client Portal Users

                                                                                                            Hello Zoho Creator Team, We hope you are doing well. We would like to request an important enhancement related to Multi-Factor Authentication (MFA) for client portal users in Zoho Creator. Currently, Creator allows us to enforce MFA for portal users,

                                                                                                          • New portal SAML authentication error: User not found

                                                                                                            Dears, Has anyone else been experiencing this lately? I am creating a new portal authenticated by SAML (Entra ID). I followed the same process as I did with other portals, but any new portal created after this always encounters this error. I’ve been reporting

                                                                                                          • Devis et facture multi page

                                                                                                            Bonjour, je suis sur Zoho invoice et je rencontre un problème sur mes devis et factures lorsqu'ils dépassent 1 page. je me retrouve souvent avec des lignes coupées ou le sous total page 1 et le total page 2. j'aimerai savoir s'il existe une possibilité

                                                                                                          • Rotate an Image in Workdrive Image Editor

                                                                                                            I don't know if I'm just missing something, but my team needs a way to rotate images in Workdrive and save them at that new orientation. For example one of our ground crew members will take photos of job sites vertically (9:16) on his phone and upload

                                                                                                          • Help with Filtering Records, HTML Pages, and Automatic File Uploads in Zoho Creator

                                                                                                            Hi Zoho Creator Community, I’m building a Zoho Creator application and need guidance on a few features I’ve been struggling with. I want to implement them safely and efficiently, and I’d appreciate any examples, tips, or best practices. I want users to

                                                                                                          • How to Send Email from within a custom module (with or without an email template)

                                                                                                            It is possible to send an email from the Deals module. However, I can't find a way to send an email from any of our custom modules. I have tried adding an email field to the modules (even though we don't really want one or need it there). That doesn't

                                                                                                          • Convert invoice from zoho to xml with all details

                                                                                                            How to convert an Invoice to XML format with all details

                                                                                                          • Feature Suggestion for Zoho Websites – Inspired by Squarespace Systems

                                                                                                            Dear Zoho Team, I’m a Zoho user and also a Squarespace Platinum Circle member, and I recently noticed the launch of Zoho Websites in India. I wanted to share some ideas for features that could enhance the platform for professional users and agencies.

                                                                                                          • Custom View - Sort by Custom Field

                                                                                                            I created a custom field for our Engineering team to know which tickets to work first by numbering them.  I created a custom view to general data which includes the Engineering Priority.  However, I cannot sort the Engineering Priority column ascending

                                                                                                          • Zoho Indeed Intergation not pulling candidate details

                                                                                                            We have recently integrated zoho with indeed. Prior to this our candidates came into the candidates tab via the zoho.resumes email address from indeed and it pulled through the candidates mobile number, and majority of the time a postcode. However since

                                                                                                          • Custom View of tickets created today

                                                                                                            How can I create a custom view that list all my ticked created in the current date? Currently, if I select the "Created Time" criteria, the "Current Time" option does not work as today. Actually, I don't know how it works this "Current Time".

                                                                                                          • Lifecycle Reports

                                                                                                            From data to decisions: A deep dive into ticketing system reports A lifecycle report captures and visualises the sequential states that a ticket undergoes across its lifespan. For instance, when a customer submits a support ticket for a faulty product,

                                                                                                          • Zoho Forms - Print Button on Forms

                                                                                                            Hi Forms team, I'm replicating a form for a client which is currently based on JotForm. I noticed that at the end of the form there is a button to print the completed form. I thought this would be something worth sharing and a nice to have in Zoho Forms.

                                                                                                          • Putting Watermark on Zoho Sheet

                                                                                                            Can this be done?

                                                                                                          • Validation function not preventing candidates under 18 or over 30 from submitting the web form

                                                                                                            Hello everyone, I’m trying to create a validation rule for the Candidate Webform in Zoho Recruit. I added a custom field called “Date of Birth”, and I want to make sure that candidates cannot submit the form unless their age is between 18 and 30 years.

                                                                                                          • Report to know the history of certain Tickets on Desk

                                                                                                            Hi there guys, As the title implies we're wondering if there's any way to get some kind of Report that allows us to check the History of various Tickets at the same time since as of today if we want to know that we have to check them 1 by 1 which is not

                                                                                                          • Advanced Usage Billing: Prepaid with Drawdown

                                                                                                            Picture yourself at your favourite coffee shop, Bean & Brew. You come by every morning for your usual cappuccino, and occasionally you get an extra cold brew and a muffin or two in the afternoon. Interestingly, Bean & Brew has a new idea of offering a

                                                                                                          • Zoho Commerce in multiple languages

                                                                                                            When will you be able to offer Zoho Commerce in more languages? We sell in multiple markets and want to be able to offer a local version of our webshop. What does the roadmap look like?

                                                                                                          • Next Page