Kaizen #168 - Incremental Authorization

Kaizen #168 - Incremental Authorization


Welcome to this week's post in the Kaizen series. In this post, we will discuss Incremental Authorization. 

What is Incremental Authorization?

Incremental Authorization is an OAuth strategy that allows a client to request specific authorization scopes as and when needed. This means that the client does not have to request every possible scope that might be needed upfront, which might result in a bad user experience. Incremental Authorization is considered a best practice in Oauth Authorization Request as:
  • Users are not overloaded with scopes in the initial stage
  • Users can control the amount of data they share

Who can use Incremental Authorization?

Server-based applications can make use of incremental authorization 

Incremental Authorization Flow

Incremental Authorization Flow

When a user first signs into the application, the application requests only the essential permissions needed. The user may trigger features that require additional permissions as they engage with the application. When the application identifies this, it follows the below steps:

Initiation Request (Step 1: Get Scope Enhancement Token )

The application makes a POST request to the endpoint /oauth/v2/token/scopeenhance, including the existing refresh token as a parameter. This request is aimed at obtaining a scope enhancement token, which is necessary for requesting additional permissions.

Scope Enhancement Request (Step 2)

After receiving the scope enhancement token, the app then makes a request to the endpoint /oauth/v2/token/addextrascope. In this request, it specifies which additional scopes are needed.

User Consent

The user is presented with a consent screen that details the new permissions being requested. This screen will only show the new permissions required and not those already granted.
If the user approves these new permissions, the refresh token (used in Step 1) and its associated access tokens will be updated to include the newly granted scopes.

Success Response

Upon successful approval by the user, a success response is returned, confirming that the additional scopes have been appended to the existing refresh token.

When is Incremental Authorization Useful?

Let us take a look at two scenarios where incremental authorization is particularly useful.

Scenario 1 

Zylker Marketing, a marketing agency, utilizes a custom in-house marketing tool that integrates with Zoho CRM.  Initially, the tool has permission to read Leads in Zoho CRM. However, as the marketing team expands their operations, they realize that they require to create new Contacts based on sign-ups and retrieve existing deals data for analysis. The tool is then revamped to create Contacts and view Deals data. 
When a marketer who uses the tool tries to create a Contact for the first time, the incremental authorization method is called in the backend. The marketer is redirected to the Zoho login page. Once logged in, the marketer is prompted to give access to the new resources. This enhances the refresh token, and the tool can continue using the same refresh token. 

Scenario 2

Consider that you want to use a new Zoho CRM API that just got released as part of the version release. Your refresh token does not have the required scope to access the new API.  You can make use of incremental authorization to append the required scope to the same refresh token in these cases.

How can you use Incremental Authorization?

Step 1: Initiation Request 

First, you need to send a request to get the scope enhancement token along with the refresh token for which the extra access is required.

Request format

POST 
{accounts-url}/oauth/v2/token/scopeenhance
?grant_type=update_scopes_token
&client_id={client_id}
&client_secret={client_secret}
&refresh_token={refresh_token}


The accounts-url is specific to the location (i.e., datacenter) where the client is registered. See all the server-specific URLs.
Request Parameters 
You should send the initiation request with the below parameters. All parameters are mandatory
  • grant_type: Specify the value as "update_scopes_token".
  • client_id: Specify the client-id obtained from the API console.
  • client_secret: Specify client-secret obtained from the API console.
  • refresh_token: Specify the refresh token to which the additional scopes should be appended.
You will receive a response in the below format
{
"access_token": "{scope_enhancement_token}",
"token_type": "update_scope",
"expires_in": 600
}

The scope_enhancement_token received in this response should be passed as a parameter in the next step - scope enhancement request.

Step 2: Scope enhancement request

This request appends the refresh token with additional scopes.
Request format
GET
{accounts-url}/oauth/v2/token/addextrascope
?response_type=update_scopes
&client_id={client_id}
&redirect_uri={redirect_uri}
&scope={required_scopes}
&enhance_token={scope_enhancement_token}
&logout=true

Parameters
  • response_type: Specify the value as "update_scopes".
  • client_id: Specify the client-id obtained from the API console.
  • redirect_uri : Specify the URI to which the authorization server will redirect the browser back with success or failure response. It has to be the same URI which is provided when registering the app in the API console.
  • scope: Specify the scopes of the additional resources for which access is required.
  • enhance_token: Scope enhancement token received in the response of the previous initiation request. 
  • logout: Specify as true if the user's session should be terminated after the permission is granted or rejected.
When this request is called, the application redirects the user to the Zoho Login page, and the user enters the Zoho credentials. Then, the permissions required are displayed once the user is authenticated.
The refresh token will be appended with the additional scopes, and a success response will be returned when the user grants permission. The user will be redirected to the redirect_uri with params status as success and scope_enhanced as true. The user can continue using the same refresh token can be used. If the user rejects the authentication, the system returns a failure response.  The user will be redirected to the redirect_uri with params error as access_denied.

You will receive a response in the below formats:

Success Response
{redirect_uri}?status=success&scope_enhanced=true

Failure Response
{redirect_uri}?error=access_denied

We hope you found this post useful. We will meet you next week with another interesting topic!
If you have any questions, let us know in the comment section.
Cheers!




      • Sticky Posts

      • Kaizen #217 - Actions APIs : Tasks

        Welcome to another week of Kaizen! In last week's post we discussed Email Notifications APIs which act as the link between your Workflow automations and you. We have discussed how Zylker Cloud Services uses Email Notifications API in their custom dashboard.

      • Kaizen #216 - Actions APIs : Email Notifications

        Welcome to another week of Kaizen! For the last three weeks, we have been discussing Zylker's workflows. We successfully updated a dormant workflow, built a new one from the ground up and more. But our work is not finished—these automated processes are

      • Kaizen #152 - Client Script Support for the new Canvas Record Forms

        Hello everyone! Have you ever wanted to trigger actions on click of a canvas button, icon, or text mandatory forms in Create/Edit and Clone Pages? Have you ever wanted to control how elements behave on the new Canvas Record Forms? This can be achieved

      • Kaizen #142: How to Navigate to Another Page in Zoho CRM using Client Script

        Hello everyone! Welcome back to another exciting Kaizen post. In this post, let us see how you can you navigate to different Pages using Client Script. In this Kaizen post, Need to Navigate to different Pages Client Script ZDKs related to navigation A.

      • Kaizen #210 - Answering your Questions | Event Management System using ZDK CLI

        Hello Everyone, Welcome back to yet another post in the Kaizen Series! As you already may know, for the Kaizen #200 milestone, we asked for your feedback and many of you suggested topics for us to discuss. We have been writing on these topics over the

        • Recent Topics

        • Is it possible to turn off all capabilities for a customer to schedule, reschedule or cancel an appointment?

          Is it possible to turn off all capabilities for a customer to schedule, reschedule or cancel an appointment? I would like to set it up so only staff can schedule appointments. Is this possible?

        • Is there a way to generate a virtual meeting for a group service in Zoho Bookings?

          Are virtual meetings not supported for group services/meetings? I have integrated Zoom with one-on-one services, but I need a way to create an online group meeting. Thanks

        • Introducing VeriFactu Support in Zoho Books

          Hello users, Spain has introduced the VeriFactu system under Real Decreto 1007/2023 to ensure integrity, traceability, and anti-fraud compliance in e-invoicing. Starting January 1, 2026, all B2B invoices must be reported to Agencia Estatal de Administración

        • Where we can change the icon in social preview

          Hi, we changed our logo, and the image that appear in preview (ex : when we post a appointment link somewhere) is still our old logo. I did change our logo in the org setting. https://bookings.zoho.com/app/#/home/dashboard/settings/basic-info?clview=false

        • Zoho Bookings changes Lead Source

          Hi. i would like to know if there's a way for Zoho Bookings to not change the lead source when booking a lead for an appointment as the lead source will be used in a report. Scenario: Lead source: Website after booking an appointment Lead source: Zoho Bookings Thanks. Dan

        • Need to set workflow or journey wait time (time delay) in minutes, not hours

          Minimum wait time for both Campaigns workflows and Marketing Automation journeys is one hour. I need one or the other to be set to several minutes (fraction of the hour). I tried to solve this by entering a fraction but the wait time data type is an integer

        • Suggestion: Associating Assets with Company in Zoho FSM

          Hello Team, I would like to share an idea based on practical experience. Currently, all assets in the Zoho FSM Asset module are linked to a specific contact person. I would like to know if it is possible to associate assets with a company instead. This

        • Zoho Inventory / Finance Suite - Extend Visibility of File Names on Attachment Fields

          Hi Inventory / Finance Suite team, I noticed recently that when you add an attachment field to a module in Inventory, only the first 8 characters of the file name are visible on the details view. 8 characters is not a useful amount and there is plenty

        • Many Notes Becoming Unusable

          Hello. The Notebook app is becoming unusable. I'm getting odd-looking results from my searches. Some of the notes, after clicking on them, show an update button that does absolutely nothing. Not sure what has happened, but it would be nice to get this

        • Kaizen #218: Actions APIs - Field Updates

          Hello all!! Welcome back to a fresh Kaizen week. In the previous weeks, we covered Workflow Rules APIs, Actions APIs - Email Notification APIs, and Tasks Update APIs. This week, we will continue with another Actions API - the Field Update API in Zoho

        • How Contract Types and Templates Form the Backbone of Zoho Contracts

          Every contract in Zoho Contracts starts with two essential elements: Contract Type and Template. These are not just administrative steps. They define how every contract in your organization is created, governed, and managed over time. Let us look at the

        • Zoho Books Finance Modules Not Accessible in Zoho CRM Mobile App

          We have integrated Zoho CRM with Zoho Books using the Zoho Finance Suite integration. In the CRM web version, we can see the Finance modules (Estimates/Quotes, Invoices, Sales Orders, Items, Payments) and are able to create invoices and quotes directly

        • Greek character in Deluxe script

          Hi, We have been using a script since 2022 which replaces characters in Greek contact names using replaceAll. Since this morning, all the Greek characters used in the script have turned to question marks. I tried retyping the characters, copy-pasting

        • CRM Related list table in Zoho analytics

          In Zoho Analytics, where can I view the tables created from zoho crm related lists? For example, in my Zoho CRM setup, I have added the Product module as a related list in the Lead module, and also the Lead module as a related list in the Product module.

        • Zoho learn Custom portal - networkurl & CustomPortalId

          I want to get my individual account’s networkurl and customportalId to use in this API: https://learn.zoho.com/learn/api/v1/portal/<networkurl>/customportal/<customportalId>/manual How can I retrieve the networkurl and customportalId using the API? I

        • Connecting zoho creator to zoho writer to send prefilled documents

          i will paste the worflow below // Get user's submitted data from the form userSalary = input.Current_Salary; userCIBIL = input.CIBIL_Score; userEmail = input.Email; userName = input.Name; // You need to get the Document ID from the URL of your Zoho Writer

        • Zoho Creator to Zoho Writer for prefilled documents...

          In response to the question about connecting Zoho Creator to Zoho Writer for prefilled documents, I wanted to share a working implementation that demonstrates how to use the record_id parameter with the Zoho Writer Merge API. This allows Writer to automatically

        • Managing functions

          Can someone let me know if there are any plans to improve the features for managing functions in CRM? I have lots of functions and finding them is hard. The search only works on the function name and the filter only works on function type. I have created

        • Introducing our latest privacy enhancement - Hiding email IDs in Zoho Cliq Networks

          Hello everyone, Zoho Cliq Networks offers a powerful collaboration platform that allows businesses to create dedicated digital workspaces for external vendors, partners, or individuals you want to communicate with professionally without adding them to

        • zoho performance

          OVERALL CONFIGURATION OF ZOHO PERFORMANCE Quarterly performance review Self rating and scoring Manager rating and scoring

        • Zoho Social API for generating draft posts from a third-party app ?

          Hello everyone, I hope you are all well. I have a question regarding Zoho Social. I am developing an application that generates social media posts, and I would like to be able to incorporate a feature that allows saving these posts as drafts in Zoho Social.

        • When will it be possible to edit Subform records via either views or tabular reports?

          Hey there, data maintenance often requires mass update of quite a lot of records. While this is a piece of cake via either List view or Zoho sheet view, the same cannot be carried out for subform records yet. When one of the two options will be made available?

        • Onboarding

          Hello Team, Im yuktha working as HR at Ossisto Technologies. We are currently utilizing zoho for onboarding candidate. right now facing issue with onboarding Attaching the screenshots for your reference

        • Archiving Contacts

          How do I archive a list of contacts, or individual contacts?

        • How do I change a form's name? Why isn't this more intuitive?

          Can someone please let me know how to change a form's name?

        • Control Over Zia Generative AI Reply Assistance Behavior

          Hello, I would like to request an enhancement to the Zia Generative AI feature, specifically concerning the Reply Assistance within Zoho Desk. Current Issue: When replying to a ticket, the Ticket Properties section is automatically replaced by the Zia

        • Zia now integrated with Open AI in Zoho Desk

          The powerful integration of Zia with OpenAI, has empowered Zoho Desk reach a new level of efficiency and performance. With contextual self-service capabilities, Zia enables agents to boost their productivity and delivers superior customer experiences.

        • Zoho Desk Partners with Microsoft's M365 Copilot for seamless customer service experiences

          Hello Zoho Desk users, We are happy to announce that Zoho Desk has partnered with Microsoft's M365 to empower customer service teams with enhanced capabilities and seamless experiences for agents. Microsoft announced their partnership during their keynote

        • Employee self-service portal: Onboarding and continuous learning platform for support reps

          Hello everyone, In any organization, employees must go through multiple courses to learn about the product, their organization's standards, and how to respond to customer queries using the knowledge base articles available. This typically requires completing

        • 2024 Email Authentication Standards: Elevating Security with Google and Yahoo

          In contemporary email communication, email authentication plays a pivotal role in mitigating email fraud, spam, and phishing attacks. Brace yourself for a new level of security. Starting February 2024, Gmail and Yahoo will be implementing robust email

        • Contact custom field in layout

          Good day, all, I have an "Extension" custom field in contacts, and would like to display the contact extension in the ticket layout, but I don't seem to be able to. What am I missing? Thanks Rudy

        • Exact match in name when searching workdrive

          Hello, I am wondering how to search workdrive files/folders with an exact match in the name. For example, when I search across folder with the url param search[name]=someName, I get multiple results such as "someName", "someNameAndMore", or "someName

        • Meeting impossible to use when sharing screen

          he Meeting tool in Brazil is practically unusable when sharing anything, whether it’s a presentation or simple navigation. When accessed via Cliq, the situation gets even worse: even basic calls fail to work properly, constantly freezing. And as you are

        • Changing the Default Search Criteria for Finding Duplicates

          Hey everyone, is it possible to adjust the default search criteria for finding and merging duplicate records? Right now, CRM uses some (in my opinion nonsensical) fields as search criteria for duplicate records which do nothing except dilute the results.

        • Is there a way to create a desktop shortcut for a website course portal?

          Hello everyone, I recently got a laptop and bought an online course from a website, Skillwint.com, which I visit regularly. I open that site many times a day and want to create a desktop shortcut so I can open it directly instead of searching in the browser

        • SalesIQ Tip for Admins: Your Safety Net for Data Recovery

          Ever clicked 'Delete' in your SalesIQ and then realized it was the wrong item? Maybe it was a prospect's chat that held important context you needed to refer to later on. Or, maybe you deleted an elaborate Zobot that you were still testing or planning

        • Depreciated mergeAndStore Function Help!

          Hello, I have a function designed to create a PDF containing information from the fields in a Deals record. There is a Writer Mail Merge template in WorkDrive that is populated via Deluge code, and a copy of the resulting PDF is then attached to the record.

        • Can I execute two 'functions' when completing a mail merge from CRM?

          Hi, I have set up a mail merge from CRM Deals to a template. I want a copy of this to be saved in Workdrive, and then a copy also saved back into the deal record from which the merge occurred. I can do both independent of each other, and managed to get

        • External Share > Edit: Cannot Create Zoho Files

          Hi Zoho, When we create an external share link with Edit permission, our external users are unable to create a Zoho file (Zoho Writer, Zoho Sheet and Zoho Show). They can only upload files. They can edit the Zoho files if we create them internally and

        • Zoho Mail iOS app update - RTL languages support and access emails using permalink and universal link, image upload resolution

          Hello everyone! In the most recent version of the Zoho Mail iOS app update, we have brought in support for RTL languages(Arabic and Urudu), providing a seamless reading experience with proper text alignment and layout throughout the app. We have also

        • Next Page