Creating leads via API

Creating leads via API

Hi

We are working with a local vendor that is generating leads for us. They have integrated with ZOHO in the past, they told me:

We need 

$refreshToken = "1000.cd05354...…...";
$clientID = "1000.4ECE...…...";
$clientSecret = "1ddf5fcd17......";

So I gather I have to create an application in the API console. That´s all good.
Thing is though that the applications you can create there require a redirect URL, I have read you can use a dummy URL so that would be fine.

What is not fine though is that there is no way to determine the scope this application can access. Remember I am giving access to an external vendor, that in this particular case is related to a competitor. We do need their product though.

The only client type that allows me to generate access with a defined scope is Self Client

But it's not clear how do we use this self client, I defined a scope and it gave me a key valid for 10 minutes.
How would the vendor use this?