Kaizen #79 - OAuth2.0 - A Recap and FAQs

Kaizen #79 - OAuth2.0 - A Recap and FAQs

Hello everyone!
Welcome to another week of Kaizen!
Today, we will address a few frequently-asked questions about OAuth2.0 that include token generation, scopes, errors etc,.
If you have any other questions, let us know in the comment section. We will offer solutions and add them to this list.
Before we move on to common errors and their solutions, let us look at generating grant, access and refresh tokens for a client.

1. Creating a client

You must register your client on the API console to request access to users' resources. This client must handle authenticating itself to the authorization server and requesting an access token to access the users' resources.
Here is an example for creating a client for a server-based application.


2. Setting up an environment in Postman

  1. On the sidebar, click Environments > + icon.
  2. Enter a name for your environment.
  3. Create the following variables. We will fill in their values as we go along.
    ->client-id (obtained after registering the client)
    ->client-secret     (obtained after registering the client)
    ->redirect-uri (    given at the time of registering the client)
    ->accounts-url
    ->access-token
    ->refresh-token
    ->api-domain
    ->expiry-time
  4. Select Save to save any environment variables you have added.


3. Generating the authorization code(grant token)

The authorization code flow is often used when the client is a web application running on a server. This flow uses a server-side redirect URI to receive the authorization code and adds a layer of security, rather than relying on a client-side redirect URI.

What do you need?

  • client ID - obtained after registering the client.
  • scopes - to get consent from the users to use their data. See the available scopes here.
  • response_type - the value "code" as we are requesting for an authorization code.
  • access_type - online or offline(to get a refresh token along with an access token, later).

What will you get?

  • code - a one-time grant token that you will use to generate access and refresh tokens.
  • accounts-server - the Zoho accounts URL that you will use to generate access and refresh tokens. This is the variable accounts-url in Postman.
  • location - the API domain from which you must make API calls to access data. This is the variable api-domain in Postman.
Tip:
If you do not have an application, yet, but want to test this flow, copy-paste the following URL in your browser with valid values for the various parameters. 
You will receive the grant token as a value to the key "code" in the redirect URL you specified while registering the client.

Here is a GIF of this process.


Self-client

Use this option if your application does not have a domain and a redirect URL.
You can also use this when your application is a standalone server-side application performing a back-end job like data sync.


4. Generating access and refresh tokens from the grant token

Access tokens allow the application to access user's data from the resource server. Each access token is valid for an hour, after which, you must use the refresh token to generate a new access token. 

Note
Each access token is bound to the scope you specified while generating the grant token, i.e, if the scope while generating the grant token was ZohoCRM.modules.READ, you can only get data from all the modules but not update, create, or delete.

What do you need to generate access and refresh tokens?

  • client_id - obtained while registering the client
  • client_secret - obtained while registering the client
  • redirect_uri - specified while registering the client
  • code - the grant token you generated in the previous step
  • grant_type - the value authorization_code

What will you get?

  • access token - the token to access users' data. Valid for an hour.
  • refresh token - the token to generate new access token for the same scope. Does not expire until it is revoked or till the 21st refresh token is created.
  • scope - the scope for which these tokens are generated for.
  • API domain - the domain to which you must make API calls to access data.
  • expiry time in seconds and milliseconds - the time after which the access token expires in seconds and milliseconds. You can use this data to programmatically refresh the access token before it expires for continued access to data.
Here is how it works.


Tip:
When you use our API collection, the request to generate access and refresh tokens comes with a script that automatically updates the values of variables in your environment.


FAQs

1. Validity

  • Grant token - Two minutes; one-time use only.
  • Access token - One hour.
  • Refresh token - does not expire until it is revoked or a 21st refresh token is created.

2. Token Limit

  • Grant token - Ten grant tokens in a span of ten minutes.
  • Access token - Ten access tokens in a span of ten minutes. When you generate the 11th token, the first-created one will be deleted, automatically.
  • Refresh token - Ten refresh tokens in a span of ten minutes. You can have a maximum of 20 refresh tokens. When you create a 21st refresh token, the first-created one will be deleted.
The following are a few common errors you may face while generating tokens.

Error
Cause
Solution
invalid_oauth_token
The access token is either invalid or has expired.
Use the right access token or generate a new one from the refresh token.
invalid_scope
The scope you have used is invalid. 
Refer to Scopes for the list of available scopes.
invalid_code
The authorization code(grant token) is invalid or has expired.
Grant token is valid only for two minutes. Use a grant token to generate access and refresh tokens within this time.
Generate a new grant token if you face this error.
invalid_redirect_uri
The redirect URI you have given in the API console is invalid.
Specify a valid redirect URI to be able to receive a grant token.
invalid_client
Either the client ID or client secret is invalid.
Specify valid client ID and secret while making authorization calls. The API console has the client ID and secret.
invalid_response_type
The value of the "response_type" key is invalid.
While generating access and refresh tokens from the grant token, the value of the "response_type" key must always be "code".

Multi-DC

Zoho CRM is hosted at multiple data centers to comply with the privacy and data protection laws of various countries.
So, if your application is in the US DC but wants to use the data of users in the EU DC, you must enable multi-DC while registering your client.

The various domains and their respective accounts URLs are:

How do you ascertain the domain?

When you generate the grant token, the parameter location gives you the DC that the data is located in.
Similarly, when you generate the access and refresh tokens, the key api_domain gives you the domain-specific API URL.
For example, if you want to get the data of leads from EU, the API URL must be https://www.zohoapis.eu/crm/v4/Leads

We hope you found this post useful. We will meet you next week with another interesting topic.

Let us know your questions in the comment section or write to us at support@zohocrm.com.

Cheers!
Shylaja

    Access your files securely from anywhere






                    Zoho Campaigns Resources




                          Zoho Developer Community



                              Bootcamp
                              Community
                              Pricing
                              Webinars
                              What's New
                              Integrations
                              Contact Support
                              Contact Sales
                                Zoho Survey Resources
                                  Features
                                  Survey Templates
                                  Integrations
                                  Community
                                  iOS Mobile Surveys
                                  Pricing
                                  Android Mobile Surveys
                                  Insurvey Blogs
                                  Insight Blogs
                                  Tips & Tricks





                                              Latest Feature Updates

                                                • Desk Community Learning Series


                                                • Digest


                                                • Functions


                                                • Meetups


                                                • Kbase


                                                • Resources


                                                • Glossary


                                                • Desk Marketplace


                                                • MVP Corner


                                                • Word of the Day


                                                • Ask the Experts




                                                    Zoho SalesIQ Resources


                                                          Manage your brands on social media
                                                          Access Zoho Social

                                                            Zoho Pagesense Resources


                                                                Zoho TeamInbox Resources

                                                                  Zoho DataPrep Resources


                                                                    Zoho CRM Plus Resources

                                                                      Zoho Books Resources


                                                                        Zoho Subscriptions Resources

                                                                          Zoho Projects Resources


                                                                            Zoho Sprints Resources


                                                                              Qntrl Resources


                                                                                Zoho Creator Resources



                                                                                    Zoho CRM Resources

                                                                                    • CRM Community Learning Series

                                                                                      CRM Community Learning Series


                                                                                    • Kaizen

                                                                                      Kaizen

                                                                                    • Functions

                                                                                      Functions

                                                                                    • Meetups

                                                                                      Meetups

                                                                                    • Kbase

                                                                                      Kbase

                                                                                    • Resources

                                                                                      Resources

                                                                                    • Digest

                                                                                      Digest

                                                                                    • CRM Marketplace

                                                                                      CRM Marketplace

                                                                                    • MVP Corner

                                                                                      MVP Corner







                                                                                        Design. Discuss. Deliver.

                                                                                        Create visually engaging stories with Zoho Show.

                                                                                        Get Started Now


                                                                                          Zoho Show Resources


                                                                                            Zoho Writer Writer

                                                                                            Get Started. Write Away!

                                                                                            Writer is a powerful online word processor, designed for collaborative work.

                                                                                              Zoho CRM コンテンツ



                                                                                                Nederlandse Hulpbronnen


                                                                                                    ご検討中の方




                                                                                                          • Recent Topics

                                                                                                          • 【開催報告】東京 ユーザー交流会 Vol.3 2025/10/17 Zoho サービスの活用促進を外部ツールとの連携で実現！

                                                                                                            ユーザーの皆さま、こんにちは。コミュニティチームの藤澤です。 10月17日(金)に新橋で「東京 ユーザー交流会 Vol.3」を開催しました。ご参加くださったユーザーの皆さま、ありがとうございました！ この投稿では、当日のセッションの様子や使用した資料を紹介しています。残念ながら当日お越しいただけなかった方も、ぜひチェックしてみてください😊 ユーザー活用事例セッション：Zoho Flowと決済システムの連携 あみろくの岡島さんに、Zoho サービスの活用事例として、Zoho Flow を活用した外部サービスとの連携事例をご共有いただきました。

                                                                                                          • received email opens in a new tab every time I log in

                                                                                                            as per the title: since about when I first made my email account, every single time Ive logged in to view my inbox, a new tab opens for an email I viewed once as if restoring a closed session. I thought I just didnt understand the "starting up" settings

                                                                                                          • Engage with your customers at scale using WhatsApp Marketing Template messages

                                                                                                            Hi everyone, To make it easier for organizations to communicate with customers, Desk now allows you to send individual, mass, and bulk WhatsApp template messages from both the Ticket and Contact modules. How is this going to benefit your business? WhatsApp

                                                                                                          • Zoho Desk iOS and Android app update: AI powered: Reply Assistance and Refine Messages on IM module.

                                                                                                            Hello everyone! We are excited to introduce new AI powered features on the IM module of the Zoho Desk app. Reply Assistance: Reply Assistance generates suggested responses for incoming chat messages, which you can directly insert into the conversation

                                                                                                          • Importation Tickets error

                                                                                                            Hi, I'm newbie here 🤓 So, i'm importing data from csv, but when I try advance to mapping fields the importer tool show this message: Previously I try import, other data, and not show errors in this step. Some ideas? Best Regards,

                                                                                                          • Missing information data Zoho inventory

                                                                                                            there some missing data in Zoho inventory connection. pick list stock counts bin location we have requested it via mail and the support team doesn’t gove feedback. has anyone achieve to get these info or to ask other ya les

                                                                                                          • Showing description in timesheet and timelogs.

                                                                                                            I am wondering if it’s possible in version 5 of Zoho People to have the description show by default or with a manipulation on the user’s part. Let me show you what I mean. As you can see this is the view for the users. Now if they want to see the full

                                                                                                          • Direct “Add to Google Calendar” Option in Zoho Meeting

                                                                                                            Hello Zoho Meeting Team, Hope you are doing well. We would like to request an enhancement related to the “Add to Calendar” functionality in Zoho Meeting. Currently, when we open Zoho Meeting and view our meetings under My Calendar, there is an Add to

                                                                                                          • Update on the client portal URL for Guest users

                                                                                                            We’re updating the way Guest users access their Connect network. As part of this change, all client organization portals used by Guest users will now be accessible through a dedicated domain specific to each data center. The access URLs mentioned here

                                                                                                          • Add Flexible Recurrence Options for Meeting Scheduling in Zoho Cliq (e.g., Every 2 Weeks)

                                                                                                            Hello Zoho Cliq Team, We hope you are doing well. Currently, when scheduling a meeting inside Zoho Cliq, the recurrence options are limited to Daily, Weekly, Monthly, and Yearly. There is no ability to set a meeting to occur every X weeks — for example,

                                                                                                          • Sales Order, Invoice and Payment numbers

                                                                                                            Hi zoho friends, it is me again, the slow learner. I'm wondering if there is a way to have it so the Sales order, invoice and payment numbers are all the same? It would be easier for me if they were the same number so there is not so many reference numbers

                                                                                                          • Ask the Experts 24: Analytics, data administration, and mobile experience with Zoho Desk

                                                                                                            Hello Everyone! Welcome back to the Ask the Experts(ATE) series! We were so focused on our Autumn 2025 release that we didn't host an ATE session last month. In this month's ATE, we'd like to expand our areas for discussion: we'd like to listen to your

                                                                                                          • Workaround: openURL in Blueprints - An alternate approach

                                                                                                            There is a roundabout way to open a URL in blueprints after a save event. By using the 'onBeforeMandatoryFormSave' in Client Script, you can open an external URL. Now, the problem is, this is designed to be run BEFORE the blueprint is saved, not after,

                                                                                                          • MTD SA in the UK

                                                                                                            Hello ID 20106048857 The Inland Revenue have confirmed that this tax account is registered as Cash Basis In Settings>Profile I have set ‘Report Basis’ as “Cash" However, I see on Zoho on Settings>Taxes>Income Tax that the ‘Tax Basis’ is marked ‘Accrual'

                                                                                                          • Migrate file from Single File Upload to Multi File Upload

                                                                                                            Dears, I have created a new field Multi File Upload to replace the old Single File Upload field. I'd like to ask you guys what is the best way to migrate the files to the new field?

                                                                                                          • Open "Live Chat" from a hyperlink?

                                                                                                            Hi, I often write paragraphs and text on our company website, and usually say you can get in touch with us via live chat. Can the chat window be triggered to pop open without clicking the chat graphic in the bottom window, and use it in a hyperlink? ie:

                                                                                                          • Zoho Sites search box

                                                                                                            Is there a Search box that can be added to a Zoho site? It would be for searching within the site only.

                                                                                                          • What stops me from packaging and shipping an order when the inventory is negative?

                                                                                                            It seems if the inventory value is negative, that Zoho Inventory should not allow me to create a Package and Ship it.   But, there seems to be nothing to stop me from doing that other than when I go to physically package the item and realize that there is no stock. There also seems to be nothing on the screen that even indicates to me that I should not package and ship.  To me this is the fundamental point of an inventory system.  Am I doing something wrong?   

                                                                                                          • Conditional formatting based on another field

                                                                                                            Hi I have two fields on my form stage 1 complete and stage 1 deadline.  I am trying to setup conditional formatting so that if stage 1 complete is after stage 1 deadline the record is highlighted in red. I need both stage 1 complete and stage 1 deadline

                                                                                                          • Zoho Books | Product updates | October 2025

                                                                                                            Hello users, We’ve rolled out new features and enhancements in Zoho Books. From iOS 26 updates to viewing reports as charts, explore the updates designed to enhance your bookkeeping experience. Zoho Books Updates for Apple Devices At WWDC 2025, Apple

                                                                                                          • Is there API Doc for Zoho Survey?

                                                                                                            Hi everyone, Is there API doc for Zoho Survey? Currently evaluating a solution - use case to automate survey administration especially for internal use. But after a brief search, I couldn't find API doc for this. So I thought I should ask here. Than

                                                                                                          • Using IMAP configuration for shared email inboxes

                                                                                                            Our customer service team utilizes shared email boxes to allow multiple people to view and handle incoming customer requests. For example, the customer sends an email to info@xxxx.com and multiple people can view it and handle the request. How can I configure

                                                                                                          • The sending IP (136.143.188.15) is listed on spamrl.com as a source of spam.

                                                                                                            Hi, it just two day when i am using zoho mail for my business domain, today i was sending email and found that message "The sending IP (136.143.188.15) is listed on https://spamrl.com as a source of spam" I hope to know how this will affect the delivery

                                                                                                          • Changing a Single-Line Text field into a Multi-line Field without losing data

                                                                                                            Is it possible to change a Single-Line Text field into a Multi-line Field without losing data. I have a module with data for which I would like to change a single-line field into a multi-line field but I'm worried it might delete the pre-existing da

                                                                                                          • Webhook - Google Sheets

                                                                                                            I have 2 forms that are both integrated with Google Sheets. I've set up a webhook to pull form 1 data from Google Sheets to prefill data in Form 2. The issue I have is that the forms name fields are First Name & Last Name but the Google sheets integration

                                                                                                          • Verified Mark Certificate

                                                                                                            Hello Dears, Can anyone help and check my mail or direct me to the desired person who can add the verification tag to my mail https://www.zoho.com/blog/mail/email-authentication-with-bimi.html

                                                                                                          • Appointment booking is temporarily unavailable

                                                                                                            Embeded Zoho booking page in my WordPress website. When someone starts a booking, after choosing time and date, an error appears before payment - "Appointment booking is temporarily unavailable due to restricted settings." Used the embeded code given

                                                                                                          • Cannot connect to 365 business calendar and Teams, says personal but it is not.

                                                                                                            hi I have a number of users connected to their 365 business accounts. Adding a new user and it thinks hes got 365 personal edition. He does not.... Anyone know what's going on. Trying for days now. Bookings go into his MS calendar but as its thinks its

                                                                                                          • Limited review (/questions) for Bookings 2.0

                                                                                                            Hi all, I'm writing this review of Bookings 2.0 for two reasons: 1) it may be of interest to others, and 2) I'd like to be corrected if I'm wrong on any points. It's a very limited review, i.e. the things that have stood out as relevant, and particularly

                                                                                                          • Zoho Bookings - Reserve with Google

                                                                                                            Does Zoho Bookings plan to to integrate with Reserve with Google?

                                                                                                          • Tip #3: How to change your booking page language

                                                                                                            Displaying your booking page in your target audience's language can greatly increase customer satisfaction. By speaking their language, you will help customers feel more comfortable scheduling with you and create a stronger connection with them. Let's

                                                                                                          • Bigin Android app update: Zoho Books integration

                                                                                                            Hello everyone! We’re excited to introduce Zoho Books integration on the Bigin Android App. Once the integration is completed in the web(bigin.zoho.com), the Zoho Books tab will be visible in detail View of Contacts, Companies, and Pipeline records. The

                                                                                                          • Bigin Android app update: Alerts while creating tasks outside of working days, conflicting events and calls.

                                                                                                            Hello everyone! In the most recent version of the Bigin Android app, we have brought in support to display an alert if task is being scheduled outside of the working days. Also, when scheduling an event or call in the Activities module, a conflict alert

                                                                                                          • Bigin update: Link email messages to pipeline records.

                                                                                                            Hello everyone! In the latest version of the Bigin iOS(v1.11.9) and macOS(1.8.9) app, we have brought in support for an option to link email to pipeline records. This helps you to view emails specific to a deal, especially when a contact is associated

                                                                                                          • Bigin Android app update: Custom buttons and widgets

                                                                                                            Hello everyone! We are excited to introduce custom buttons and widgets on the Bigin Android app. Widgets: A widget is a customizable UI component in Bigin that improves efficiency and user experience. It lets businesses embed components, streamline interactions,

                                                                                                          • Biometric Access Support on Zoho Vault Desktop App

                                                                                                            Is there any plans to add biometric authentication (fingerprint, face recognition) for Vault desktop apps (Windows/macOS) to enhance security and ease of access. I would love to hear other members view on this

                                                                                                          • Zoho Sheet for Desktop

                                                                                                            Does Zoho plans to develop a Desktop version of Sheet that installs on the computer like was done with Writer?

                                                                                                          • Zoho Sheet - Desktop App or Offline

                                                                                                            Since Zoho Docs is now available as a desktop app and offline, when is a realistic ETA for Sheet to have the same functionality?I am surprised this was not laucned at the same time as Docs.

                                                                                                          • Collective-booking event not added to all staff calendars

                                                                                                            We assign two staff to certain events. When the client books this event, it adds it to one staff calendar (the 'organiser') but not the other. How can I ensure all staff assigned to a collective booking get the event in their calendar? (A side note: it

                                                                                                          • Project Management Bulletin: October, 2025

                                                                                                            Every need leads to innovation. Project Management tools were developed out of sheer necessity to drive large projects. With wide usage, the specifications grew precise, and so did the refinement. Over years we’ve crafted one of the best project management

                                                                                                          • Next Page