The Zoho Recruit API uses the OAuth 2.0 protocol for authentication. It uses the Authorization Code Grant Type to obtain the grant token (code). This grant type allows you to share specific data with any application while keeping your usernames and passwords private. This protocol provides users with a secure and easy way to use authentication.
The generation flow for Zoho Recruit's OAuth Authentication involves 5-simple steps. Use the links provided below to navigate between these pages.
- Step 1: Registering a Client
- Step 2: Making the Authorization Request
Why use OAuth 2.0?
- You can revoke a customer's access to the application any time
- No need to disclose credentials to clients
- No information will be revealed even if the client is hacked, since access tokens are issued to individual applications and not the client as a whole
- Specific scopes can be applied to either restrict or provide access to certain data for the client, which will be different for each client application
How does OAuth 2.0 work?
Here are some terms you need to know before you start using the Zoho Recruit APIs.
Zoho Recruit resources, such as Candidates, Contacts, Job Openings, etc.
The Zoho Recruit server that hosts the protected resources.
Any end user of your account who can grant access to the protected resources.
An application that sends requests to the resource server to access the protected resources on behalf of the end user.
The consumer key generated from the connected application.
The consumer secret generated from the connected application.
The authorization server provides the necessary credentials (such as access and refresh tokens) to the client. In this case, it will be the Zoho Recruit authorization server.
A temporary token created by the authentication server and sent to the client via the browser. The client will send this code to the authorization server to obtain access and refresh tokens.
A token that is sent to the resource server to access the protected resources of the user. The access token provides secure and temporary access to Zoho Recruit APIs and is used by the applications to make requests to the connected app. Each access token will be valid only for an hour, and can be used only for the operations that are described in the scope.
A token that can be used to obtain new access tokens. This token has an unlimited lifetime until it is revoked by the end user.
Zoho Recruit APIs use selected scopes which control the type of resource that the client application can access. Tokens are usually created with various scopes to ensure improved security. For example, you can generate a scope to create or view a lead or to view metadata.
Scopes contain three parameters—service name, scope name, and operation type.
The format to define a scope is scope=service_name.scope_name.operation_type
Here, ZohoRecruit is the service API name, modules is the scope name, and ALL is the operation type.
settings.all, settings.custom_views, settings.related_lists, settings.modules, settings.fields, settings.layouts
modules.all, modules.candidate, modules.client, modules.contact, modules.jobopening, modules.campaign, modules.task, modules.event, modules.call, modules.interview, modules.vendor, modules.custom,modules.notes,modules.activities,modules.assessment,modules.candidatestatus,modules.jobopeningstatus
Group scopes provide complete access to all functions the user can perform on the record. For example, a group scope can allow a user to read, create, update, and delete records in all modules.
In the above example, the user has access to all modules in the client Zoho Recruit account.
Other examples are:
- scope=ZohoRecruit.modules.READ (read-only permission)