Kaizen #116 - Client Types in Zoho API Console

Kaizen #116 - Client Types in Zoho API Console

Hello everyone!
Welcome back to another post in the Kaizen series!

This week, we will discuss different client types available in Zoho API Console, and when to use each.

When you register an app in Zoho API Console, you typically choose a client type based on how your application interacts with Zoho services.
Let us discuss the available client types and how authorization is handled for each.

Available client types

  1. Server-based
  2. Client-based
  3. Self client
  4. Non-browser-based
  5. Mobile-based

1. Server-based

If you have a web-based application that runs on a dedicated HTTP server and interacts with Zoho services by calling Zoho APIs via that server, you must register your app with this client type.
This client type is for applications that redirect the users to another URL on a web browser to authorize themselves, where they give consent to your application to use their data.
In other words, you must use this client type when you have a front-end web UI and require user intervention before your app can access user data via the dedicated server.

Consider that you are developing a web-based custom application. Users authorize that app via browser to allow their Zoho CRM data to be accessed and used by that application.
During the registration process in Zoho API Console, you would choose the "Web-based" client type.
OAuth 2.0 would be used for user authentication, allowing your app to securely access and interact with Zoho CRM data on behalf of the users.

Here is a gist of what happens:
  1. Users visit your website where you have the Login with Zoho button.
  2. When a user clicks it, that user will be redirected to accounts.zoho.com with the details of your app such as client ID, scope, redirect uri, access type as the URL parameters.
  3. Your app must make an API call to Zoho Accounts with the client ID, scope, redirect uri, and access type. Users are shown the data that your application wants to use.
  4. When users give their consent, Zoho redirects them back to your app.This will be the "Redirect URL" you give while registering your app.
  5. The redirect URL will have the authorization code(grant token) as one of the parameters, along with the location(user's domain).
  6. Your app must then make API calls from your web server to Zoho Accounts to generate access and refresh tokens with the generated grant token.
  7. You must store these tokens in your DB to access that user's data in Zoho CRM. While making API calls, you must send this access token in the header.
  8. Your app must also have the logic to regenerate access tokens from refresh tokens when the access token expires.
Note that your app must take care of storing user's details like email, organization ID, and tokens.

The following image shows the protocol flow.


You can use any of our server-side SDKs to simplify this process.
When you use our SDK, all you have to do is, generate the grant token and initialize the SDK with the client details and this token. The SDK takes care of access token generation, refreshing it, and token storage.


For more details, you can refer to the Accounts guide and CRM help doc.

2. Client-based applications

This client type is for applications that do not have a server and run exclusively on a web browser.
This is also called the Implicit flow as your app makes API calls to Zoho only when users are using your app.
This type of application loads data dynamically on the webpage, and accesses Zoho CRM data by making API calls via Javascript.

Consider the same example where there is a Login with Zoho button on your webpage.
Here is a gist of what happens when a user clicks it.
  1. Your app redirects the user to Zoho Accounts.
  2. Your app makes the authorization request with the client ID, redirect uri, scope, and response type as token.
  3. The user is shown the data that your webpage would use.
  4. When the user gives consent, Zoho Accounts sends the access token to the redirect uri as a parameter, along with the expiry time and the location of user's data in Zoho's accounts server.
  5. You can include the "email" in your scope parameter in the access token request to get user's information. The response will have a parameter called id_token that will be in the header.payload.signature format. You need to decrypt the payload section of the parameter using the base-64 decryption algorithm to get user information.
  6. Your app must then make API calls to Zoho with this access token to fetch data.
  7. When the access token expires, your app must take care of regeneration and storage.


As the API calls are made from your domain to a different domain(zohoapis.com), for security reasons, the browser will throw the CORS error. So, your domain will be registered while registering your app, and Zoho will know to allow the API calls made from that domain.

As the tokens are available on the browser itself, we recommend handling them with care.
When you use our client-side JS SDK, it automatically generates a new access token upon expiry.

3. Self Client Applications

When your application does not have a redirect URL or a UI, but performs only a backend job, and does not need user intervention, then you must choose this client type.

A self client is often used when the application and Zoho services are operated by the same entity, and you want to enable secure communication between them. For example, you have an internal reporting tool and integrate it with Zoho Analytics. In this case, both the tool and Zoho Analytics are operated by the same entity.
Similarly, consider that you have a legacy product management system and want to perform data sync between Zoho CRM and the system, then you must use the self client.

Here is a gist of what happens.
  1. You register your app as self client in Zoho API Console.
  2. You will get the client details such as ID and secret.
  3. You provide the scopes required for your app to access CRM data.
  4. You will receive the grant token.
  5. Your app must then make API calls to Zoho Accounts to generate access and refresh tokens.
  6. Your app can then use this access token to make API calls to Zoho CRM and use data.
You can refer to our older Kaizen post on this topic for more details.
Note that self client apps can also use any of our server-side SDKs. As already said, the SDK takes care of access and refresh token generation, refreshing the access token, and token storage.

4. Non-browser applications

This client type is for devices that do not have a user agent such a web browser. A TV, for instance.
Let us consider an example involving a smart TV application that integrates with Zoho ShowTime. In this scenario, the smart TV application acts as a non-browser client.
Here is how authentication is handled:
  1. You must register your smart TV app in Zoho API Console with the type "Non-browser application".
  2. Users install a dedicated Zoho ShowTime application on their smart TVs.
  3. When users launch the Zoho ShowTime application on their smart TV, they are prompted to authenticate with their Zoho ShowTime account.
  4. When they successfully authenticate, Zoho Accounts sends the grant token to your app, along with the user-code, device-code and verification URL,The user must go to this verification URL on a browser and enter the user-code to grant permission to the app.
  5. Meanwhile, your app must poll the accounts server using the grant token to check if the token has been received.
  6. When the user enters the user code, Zoho Accounts sends the access token to your app.
  7. Your app can then use the access token to make API calls to Zoho. Your app must take care of token storage and renewals.

Here is the protocol flow. For more details, refer to this doc.


5. Mobile-based applications

You must use this client type when you have developed an app exclusively for mobile devices. The protocol flow is similar to server-based application where a browser session is required for the users to authenticate.



Similar to server-side apps, mobile apps also need to handle redirection, token generation and storage.
If you use any of our Mobile SDKs, the SDK itself handles token generation and storage.

We hope you found this post useful. Let us know your thoughts in the Comment section or write to us at support@zohocrm.com.


Cheers!

    • Recent Topics

    • Custom Project View by Project Group

      Hi Zoho Team, I used to have a custom project view which showed all my active projects (not cancelled or completed) and the list was separated into projects groups. Some time ago, possibly a couple of months ago, I began to see all projects even cancelled

    • Unable to attach the file via the API.

      We are trying to attach files to a Candidate in Zoho Recruit using the API. We reviewed the following API documentation: 🔗 Upload Attachment While this API does allow file attachment via a URL, that’s not what we want — we do not want to attach public-facing

    • Zoho Books (UK) needs to be able to submit a CT600 CTSA return

      As well as a VAT Return, most (if not all) small businesses have to submit a CT600 Corporation Tax Self-Assessment. There are many providers who do this (like Xero) bujt not Zoho. Can you add this to the request list please? Many thanks Steve

    • Stock Update After Approver 1 Approval in Multi-Level Approval Flow

      Hi Team, We have configured a multi-level approval process for POs/Bills. Our requirement is to update the item stock quantity based on the billed quantity immediately after Approver 1 approves the bill. Please find the script attached below. However,

    • Zoho Form Auto Fill

      I am setting up a Zoho form for my independent sales reps to request quotes. Their names are in the first field under a dropdown menu. The next field is their email address. I want the email address field to automatically be filled in when they select

    • Image Resolution Restriction Option in Zoho Forms File Upload

      Hi Zoho Forms Team, Greetings, We would like to request a feature enhancement for Zoho Forms regarding the file upload field. Currently, Zoho Forms allows us to restrict the file size of uploaded images, but not the image resolution (in megapixels). This

    • Can't select Leave type while applying a leave

      Hello, while trying to apply a leave, I can't find any leave type among the options in the Leave type select: Here are my leave settings. Daily: Hourly: Tried to clear cache and to navigate from another browser, but the problem persists. Any hint? Thank

    • Mes débuts sur Zoho Forms | 13 champs à l'export ! seulement

      Bonjour, je débute sur Zoho Forms, je viens de créer un formulaire avec tests dans la foulée et je n'ai que 13 champs qui remontent sur mon export CSV alors que j'ai plus de questions et champs qui devraient remonter. J'ai actuellement une formule payante

    • Introducing real-time document commenting and collaboration in Zoho Sign

      Hi, there! We are delighted to introduce Document commenting, a feature that helps you communicate with your recipients more efficiently for a streamlined document signing process. Some key benefits include: Collaborate with your recipients easily without

    • Adding Photos Into Form (as a form creator)

      As the form creator, is it possible to add images to my form? (I don’t mean adding an image upload field, but rather inserting a JPG file into the form so that users can view the image.)

    • [Training] AI-Powered Application Development Bootcamp 2.0 - Zoho Creator

      Hello everyone, Ready to take your app-building skills to the next level with the power of AI? We’re excited to invite you to AI-Powered Application Development Bootcamp 2.0—a 90-minute, live training session designed to help developers, business users,

    • What is the easiest/fastest way to attach an email or PDF to a Zoho record?

      Hi everyone, We use Outlook with Office 365 and have the need to either ideally attach a .msg email directly to an account or custom module in Zoho, or if not attach just the PDF that would be sent in that email. The Zoho plugin is very basic for Outlook

    • Free webinar! Close deals faster with Zoho Sign from Zoho CRM

      Hello, Are you tired of chasing down signatures and getting stuck with paperwork delays in your sales process? With the seamless integration between Zoho Sign and Zoho CRM, you can create and send documents for signing online, close deals faster, and

    • Files stores in Library Marketing Automation

      Hi, How can i switch from card view to list view in Marketing Automation My Files.?

    • Paid for upgrade and no change

      I paid the $24.99 rate to upgrade to Pro version and no change when I signed out and signed back in.

    • Issue with Code Snippet Styling Overlap in Zoho Landing Page

      Dear Support Team, I have encountered an issue on the Zoho Landing Page while working with code snippets. When I try to create a custom script and add HTML, CSS, and JavaScript within the code snippet, the styling appears to overlap and affect other code

    • Adding yearly Calander

      How to add Yearly calander and employee data from admin console

    • Zoho Leave Policy > Portugal maternity Leave 120 days or 150 days

      Hello All In this Portugal maternity Leave policy, the government allow employee to apply 120 days they will have 100% paid salary if they apply 150 days they take 80% of the paid salary minimum 1 days and maximum 120 days or 150 days Should i setup this

    • Feature Request - Copy Reschedule Link

      Hi Bookings Team, I had a client contact me today, to let me know that she can't make a meeting she booked this week. I can't remember if I included a reschedule link in email notifications, but I was thinking that it would be great if I could just open

    • eCommerce ZUG Virtual Meetup – Critical Role of e-Signatures in eCommerce

      Hello there! Are you in the ecommerce industry and looking for a secure, compliant e-signature solution to handle all your paperwork? From vendor onboarding and supplier contracts to internal HR and finance workflows, speed, scalability, and customer

    • Zoho Desk iOS app update: Archived ticket list view

      Hello everyone! In the latest iOS version(v2.10.7) of the Zoho Desk app update, we have brought in support to access the 'Archived Ticket views' on the 'Ticket Views' screen. Tickets that have been Closed and inactive for 120+ days will be automatically

    • Chart of Accounts

      Is it possible to reorder chart of accounts manually? Currently, when creating new sub accounts accounts, they appear in order they were created i.e. not in alphabetical or numerical order based on manually assigned account codes. It's very messy! Also,

    • Zoho People Candidate Unable to see Non Admin Data

      Hello All I have assign this user as specific user as Group CEO and have access all legal entity, business unit division When i login to the user and look into onboarding i do not see any data in the candidate view This is the admin view that i have 2

    • Issues With Image Formatting when Importing Word Documents as Articles

      Hello, I am having formatting issues when importing .docx files into articles. The documents look fine on Word, but once they are imported into an article, the images will overlap text and other images. Occasionally there will be added space between images

    • ZOHO COMMERCE 2.0 – Réinventer la vente, repenser la valeur

      Il y a cinq ans, nous avons lancé Zoho Commerce pour accompagner les entreprises dans la vente en ligne. À cette époque, notre objectif était clair : simplifier l'e-commerce. Aujourd’hui, le marché a évolué, tout comme les attentes des entrepreneurs.

    • Business hours in reports

      Hi. If I activate the business hours for my tickets. Does it affect in reports? I mean, if before, without working hours a ticket comes in on a Monday and closes the following Monday, in the resolution time in working hours I get 7 days. I want to know

    • Zia Field Prediction - Unable to Validate Dataset Entries

      Lastly, whenever we want to create a new field prediction, the status gets stuck in Incomplete and when I try to annotate tickets, I get an error message saying "Unable to validate dataset entries." I've tried deleting and recreating the prediction, but

    • Using an article already existing in Zoho Desk KB as a resolution for another tickets

      Hi, I've read about the Resolution tab of the Tickets and the ability of adding a Resolution to the Knowledge Base so that both agents and customers be able to access this information. However, and considering several tickets may be solved by following the same procedure, here's my question: if, for a ticket, I solved it and added the way I solved it as an article in our KB, is it possible to grab that article and use it as a resolution for another tickets with similar characteristics? If it's not,

    • How to create knowledge base article from api?

      How to create knowledge base article from api?

    • Disabling Smart Writing Assistant

      Hello, I've found this article when looking to disable the Zoho Smart Writing Assistant in our Zoho Desk environment. I appreciate that the article is for another Zoho solution, however, I was still unable to disable this feature! Could we please have

    • Append tags to records on import

      Dear Customers, We hope you're well! Tags in Zoho CRM are humble labels you can earmark your records with for quick classification and recognition. You can tag records one by one when you have only a few records to update; you can automate tagging when

    • "Recently Changed Payload Format" for webhooks in Zoho Billing

      We are seeing a message about recently changed payload format for webhooks in zoho billing. I cannot find any notification about this change can you give me more information on this?

    • Kaizen #198: Using Client Script for Custom Validation in Blueprint

      Nearing 200th Kaizen Post – 1 More to the Big Two-Oh-Oh! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.

    • Zoho People Created a UBO/Group CEO Profile to view all employees

      Hello All I have created a specific role UBO/ Group CEO Profile that is able to access to view all employees information Applicability i have input all the legal entity, business unit and division which most employees are added. I have also given access

    • We've updated the webhook payload format

      We’ve updated the default payload format for webhooks as part of our ongoing efforts to standardize the webhook format across Zoho Finance suite of applications. Note: This change is also applicable for the webhooks configured from the Developer Portal.

    • Zoho People > Access of Left Menu

      Hello All May I check how do i activate or de-activate of the left menu for users do i control via role or specific role? I have assign a user to Team member

    • Custom Button - Location Choice is not changeable in creation

      I created a custom button for the Tasks module that calls a function to streamline mass updates of closing tasks as "complete". I want to place it in either the utility menu or the mass action menu, but when I create the button the "select page" field

    • Workflow on Clone

      Hello. I'm interested on creating a workflow on a clone of a record in the Price_Books module that will clone also all the related Products and associate the new ones with the new Price_Book. My problem starts with that there's no On Clone event, only

    • How can I create a button in a widget that pops up a form created in ZOHO Creator when clicked?

      I know that using HTML snippets, clicking the button can pop up the form. However, the same code does not work in the widget. <button><a href="#Form:form2?zc_LoadIn=dialog">Add</a></button>

    • Introduce an option to hide the form title

      My feature request is to include an option to hide the form title. At the moment it is possible to hide the header. In some cases I do want to show a logo image in the header but not the form title. As a workaround I have tried disabling the header and

    • Next Page