Kaizen #116 - Client Types in Zoho API Console

Kaizen #116 - Client Types in Zoho API Console

Hello everyone!
Welcome back to another post in the Kaizen series!

This week, we will discuss different client types available in Zoho API Console, and when to use each.

When you register an app in Zoho API Console, you typically choose a client type based on how your application interacts with Zoho services.
Let us discuss the available client types and how authorization is handled for each.

Available client types

  1. Server-based
  2. Client-based
  3. Self client
  4. Non-browser-based
  5. Mobile-based

1. Server-based

If you have a web-based application that runs on a dedicated HTTP server and interacts with Zoho services by calling Zoho APIs via that server, you must register your app with this client type.
This client type is for applications that redirect the users to another URL on a web browser to authorize themselves, where they give consent to your application to use their data.
In other words, you must use this client type when you have a front-end web UI and require user intervention before your app can access user data via the dedicated server.

Consider that you are developing a web-based custom application. Users authorize that app via browser to allow their Zoho CRM data to be accessed and used by that application.
During the registration process in Zoho API Console, you would choose the "Web-based" client type.
OAuth 2.0 would be used for user authentication, allowing your app to securely access and interact with Zoho CRM data on behalf of the users.

Here is a gist of what happens:
  1. Users visit your website where you have the Login with Zoho button.
  2. When a user clicks it, that user will be redirected to accounts.zoho.com with the details of your app such as client ID, scope, redirect uri, access type as the URL parameters.
  3. Your app must make an API call to Zoho Accounts with the client ID, scope, redirect uri, and access type. Users are shown the data that your application wants to use.
  4. When users give their consent, Zoho redirects them back to your app.This will be the "Redirect URL" you give while registering your app.
  5. The redirect URL will have the authorization code(grant token) as one of the parameters, along with the location(user's domain).
  6. Your app must then make API calls from your web server to Zoho Accounts to generate access and refresh tokens with the generated grant token.
  7. You must store these tokens in your DB to access that user's data in Zoho CRM. While making API calls, you must send this access token in the header.
  8. Your app must also have the logic to regenerate access tokens from refresh tokens when the access token expires.
Note that your app must take care of storing user's details like email, organization ID, and tokens.

The following image shows the protocol flow.


You can use any of our server-side SDKs to simplify this process.
When you use our SDK, all you have to do is, generate the grant token and initialize the SDK with the client details and this token. The SDK takes care of access token generation, refreshing it, and token storage.


For more details, you can refer to the Accounts guide and CRM help doc.

2. Client-based applications

This client type is for applications that do not have a server and run exclusively on a web browser.
This is also called the Implicit flow as your app makes API calls to Zoho only when users are using your app.
This type of application loads data dynamically on the webpage, and accesses Zoho CRM data by making API calls via Javascript.

Consider the same example where there is a Login with Zoho button on your webpage.
Here is a gist of what happens when a user clicks it.
  1. Your app redirects the user to Zoho Accounts.
  2. Your app makes the authorization request with the client ID, redirect uri, scope, and response type as token.
  3. The user is shown the data that your webpage would use.
  4. When the user gives consent, Zoho Accounts sends the access token to the redirect uri as a parameter, along with the expiry time and the location of user's data in Zoho's accounts server.
  5. You can include the "email" in your scope parameter in the access token request to get user's information. The response will have a parameter called id_token that will be in the header.payload.signature format. You need to decrypt the payload section of the parameter using the base-64 decryption algorithm to get user information.
  6. Your app must then make API calls to Zoho with this access token to fetch data.
  7. When the access token expires, your app must take care of regeneration and storage.


As the API calls are made from your domain to a different domain(zohoapis.com), for security reasons, the browser will throw the CORS error. So, your domain will be registered while registering your app, and Zoho will know to allow the API calls made from that domain.

As the tokens are available on the browser itself, we recommend handling them with care.
When you use our client-side JS SDK, it automatically generates a new access token upon expiry.

3. Self Client Applications

When your application does not have a redirect URL or a UI, but performs only a backend job, and does not need user intervention, then you must choose this client type.

A self client is often used when the application and Zoho services are operated by the same entity, and you want to enable secure communication between them. For example, you have an internal reporting tool and integrate it with Zoho Analytics. In this case, both the tool and Zoho Analytics are operated by the same entity.
Similarly, consider that you have a legacy product management system and want to perform data sync between Zoho CRM and the system, then you must use the self client.

Here is a gist of what happens.
  1. You register your app as self client in Zoho API Console.
  2. You will get the client details such as ID and secret.
  3. You provide the scopes required for your app to access CRM data.
  4. You will receive the grant token.
  5. Your app must then make API calls to Zoho Accounts to generate access and refresh tokens.
  6. Your app can then use this access token to make API calls to Zoho CRM and use data.
You can refer to our older Kaizen post on this topic for more details.
Note that self client apps can also use any of our server-side SDKs. As already said, the SDK takes care of access and refresh token generation, refreshing the access token, and token storage.

4. Non-browser applications

This client type is for devices that do not have a user agent such a web browser. A TV, for instance.
Let us consider an example involving a smart TV application that integrates with Zoho ShowTime. In this scenario, the smart TV application acts as a non-browser client.
Here is how authentication is handled:
  1. You must register your smart TV app in Zoho API Console with the type "Non-browser application".
  2. Users install a dedicated Zoho ShowTime application on their smart TVs.
  3. When users launch the Zoho ShowTime application on their smart TV, they are prompted to authenticate with their Zoho ShowTime account.
  4. When they successfully authenticate, Zoho Accounts sends the grant token to your app, along with the user-code, device-code and verification URL,The user must go to this verification URL on a browser and enter the user-code to grant permission to the app.
  5. Meanwhile, your app must poll the accounts server using the grant token to check if the token has been received.
  6. When the user enters the user code, Zoho Accounts sends the access token to your app.
  7. Your app can then use the access token to make API calls to Zoho. Your app must take care of token storage and renewals.

Here is the protocol flow. For more details, refer to this doc.


5. Mobile-based applications

You must use this client type when you have developed an app exclusively for mobile devices. The protocol flow is similar to server-based application where a browser session is required for the users to authenticate.



Similar to server-side apps, mobile apps also need to handle redirection, token generation and storage.
If you use any of our Mobile SDKs, the SDK itself handles token generation and storage.

We hope you found this post useful. Let us know your thoughts in the Comment section or write to us at support@zohocrm.com.


Cheers!

    • Recent Topics

    • Surely it's time Inline editing from views

      I think the first request I found for in-line editing from grids was approximately 12 years ago - that post was locked because it was suggested Zoho sheetview solved the problem. However, it's now 2024, and in-line editing from grids is just a basic expectation.

    • Issue with POST request creating Calls in CRM

      Hello, I am in the middle of integrating some 3rd party Call center API with Zoho CRM and going through our logs I see some discrepencies. We sometimes get an error: {"data":[{"code":"INVALID_DATA","details":{"api_name":"Call_Duration","json_path":"$.data[0].Call_Duration"},"message":"Please

    • only lastname as index(?) field in custom module

      Hello, I have a small problem. I have created a custom module. The data records are only labeled with the last names. Also in the lookup etc.... It's stupid if you have different first names with the same surname. Then I only ever see the surname. In

    • How to read content out of File (Excel, Zoho Sheet, CSV) and iterate through rows

      Hello, I'd like to be able to iterate through all the rows in a CSV or Excel/Zoho Sheet file to perform actions on them. How is this possible in Flow? Thanks in advance! Best regards, Sven

    • Import CSV file into Zoho CRM using Zoho Flow?

      Is there a way to automate the import of contacts from Zoho Flow to Zoho CRM? I have a csv file on a remote server that I would like to pull off and import/update on a schedule.  I know you can do it with Zapier but I would like to stay within the Zoho

    • TDS Filing

      Is there any option for automatic 26Q and 24Q filing in Zoho books. Even Tally has this option. Why don't Zoho has this ? Is there any customisation available for this ?

    • Sorry to inform you that currently we cannot access the subform fields through writer deluge (zoho.writer.mergeAndSend).

      This is the premium support answer from zoho. It means we cannot merge and send thru deluge related records (sub forms) items... Has anybody suffered from the same ordeal ? DO you have a workaround ? If not can you vote for this feature to be added to

    • Quotes

      Has anyone figured out how to automatically upload a quote that was signed via Zoho Sign and insert it directly to that leads file and push it through the pipeline to proposal signed status?

    • I wan to schedule a meeting report From previous Thursday to this thursday of this week on Every 6 pm want to recive this report in zoho CRM

      I wan to schedule a meeting report From previous Thursday to this thursday of this week on Every 6 pm want to recive this report in zoho CRM. How I Can achive this in Zoho CRM.

    • Importing a contact with a linked product

      Hi, I'm trying to import my contacts from an excel spreadsheet and each of those contacts have fields that relate to products. Is there a way that I can import the contact with their linked product? Some of the contacts in my spreadsheet have multiple

    • CRM - Workflow Rules to be applied and work across modules

      Hello, It seems that you can't use workflow rules in CRM to work across modules, is this correct? I need a customer account status to be changed IF there have been no new deals or new quotes in the last 6 months. I can't see this is possible? I can create

    • Auto assign account owner

      hi, i need to auto assign leads and accounts to an owner by rules. i have created all the territories i need, and all territories have their owner. but when i want to auto assign a new or an existing account to a user by the rules of territories, only

    • How do I enter phone extensions?

      How do I add a phone extension correctly so that when I dial the main number it will pause and dial the extension of the contact I want to talk to Greg

    • How do you make tabs and place certain leads in them?

      I am trying to figure out how to make a tab for my Florida contacts, California contacts and New York contacts. I make a new view named "Florida Leads" but when I click on it, ALL of my leads pop up in the same view... Is there a way to move leads into different categories? Thanks, Wayne

    • Boolean Fields in Mail Merge Displaying as Checkmarks

      I'm really liking the new mail merge functionality. It's replaced the Zoho Sign extension for us. One problem I've seen is that boolean operators (i.e. Checkbox fields) in CRM merge as "True" or "False". This looks a little ugly in my final document —

    • Web to lead form not working

      I am starting to use this Zoho product (3 users for free) to see if it really does what it should prior to making a purchase decision. One of the important parts of the ZOHO CRM is the ability to create a web form that auto generates a lead. We have set

    • Is this a valid email from Zoho or a scam?

      Hi, I received an email advising me to update MX records for Zoho mail. Is it legitimate? Thanks, Nelson. Dear Admin, You may know that your domain (eg, yourcompany.com) has an MX record that points to an email server configured to process email for your domain. We have noticed that some of our customers have used Zoho IP address (instead of DNS server name) in their MX records to specify the mail server. This is NOT recommended practice. Vendors will sometimes change IP addresses for number of valid

    • Search on Postcode criteria not working properly

      Hi there, I used to be able to do an advanced candidate search on 'Postcode starts with' and then enter the first two letters of the UK postcode.  So if I used CH then it would bring back candidates in CH1, CH2, CH3 etc.  This seems to have changed in the last week so that it now only brings back postcodes that exactly match CH only.  I tend to use this search criteria extensively so need a fix for it asap please.

    • Quotes vs Invoices vs Sales Orders

      We have the need to create either quotes, invoices or sales orders for services we provide to clients for our sales team to present to them.  However, we are confused in the purpose of each and which we should choose.  Could someone explain the difference in them? Also, with these, we will have setup costs for our clients and then fixed monthly costs.  For instance, we have services that are one-time services at $997 and then we have others that are monthly only ($250 per month).  In addition, we

    • Tip 14: How to iterate a set of Deluge code a specific number of times.

      Hello folks, As you might already know, recursive functions are used to perform a particular action a specific number of times. We had explained this in detail in our Tip #2. Similarly, there is another way in which you can iterate a set of Deluge code 'n' number of times. All you need to do is to create a List and use the For each index task to iterate it for a specific number of times.    Here are a few use cases where this would be useful to you:  To create 'n' number of duplicate records for

    • Can't set conditional layout rule on lookup field in Zoho CRM

      Namaskaram Zoho CRM team,      Usually any fields of module except mandatory fields can be hide using conditional layout rules.  But that can't be set on lookup fields event that is not a mandatory fields.  Many users are in need of that.   Crafted with

    • Online Calculator

      Created a public shipping volume calculator for my website visitors to use. its pretty cool when you combine the power of zoho sheets and the web experience. I chose zoho because our users dont need to login or created acct like google doc users. this is great because ppl will accept the technology more without resistance. you can see the online calculator here: hxxp://www.dblusa.com/dbl_calculator.php peace! RSA

    • All about Users in Zoho Projects

      To form a functional team, businesses should define different types of users in their team. Businesses can be effectively managed by inviting users to various roles. And, the person who has the administration privileges can invite or add users to various roles in the project. Two types of users Before going into the steps to add users to your portal or project, let's understand the different types of users:  Portal Users - Users who work for the projects in your team.                      ~ Portal

    • Zoho Projects API 100 requests/2 min. Limit

      Hi Requesting clarification on the API documentation. "You can invoke or call an API for 100 times in a span of two minutes. If you invoke more than 100 times, the particular API request will be locked for the next 30 minutes. " Does this limit apply

    • Calendar Connection Enhancement

      Hello everyone, Greetings from the Bookings team. We're here to announce an important Calendar enhancement that will roll out soon. Let's take a look at what's being changed. Improved and more straightforward UI The Calendars UI is undergoing a complete

    • Bookings to CRM - New Events and Contacts

      Hello, I have an issue with appointments taken by clients from a Zoho Bookings page. Previously when an appointment was reserved, if there were no client created in Zoho CRM, it would create it in the CRM through the integration between both platform.

    • Generating Discount Coupons for Zoho Bookings

      Hi, Is there provision to generate Discount Coupons for appointment bookings? I could not see that in the settings and this is very much needed. Please suggest us. Thanks

    • How do I remove mail hosting?

      I have a problem, I can't remove mail hosting. I need to remove them to cancel my domain, but it's imposible to cancel or remove the mail hosting. Please I need help urgently to resolve this problem.   Thanks

    • Notes created in mobile app not syncing with web notebook

      I have created certain notes in a new notebook in mobile app. The new notebook is also created using mobile app and when I logged in through web I am unable to see notebook that I have created using mobile app. there is no trace of notes in which i have created in mobile app on the web even after days of creating in mobile app This is not the case vise-a-versa. the notes and note book created on web are accessible on mobile app on real time.  this is very inconvenient and big demotivating factor

    • Desk - CRM Integration: SPAM Contacts (Auto Delete)

      SPAM contacts is a useful feature, but when the CRM sync is used, it is very frustrating. When a contact is marked as SPAM on Desk, I wish to do the same on CRM. When a SPAM contact is deleted, I would like it deleted from CRM. The feature looks half-baked.

    • No more IMAP/POP/SMTP on free plans even on referrals with NO NOTICE

      Outraged. Just referred a colleague to use her domain (not posting it publicly here) to Zoho, just as I have other colleagues, clients, friends. Expected the exact same free plan features as I have and as everyone else I ever referred got. I was helping

    • Mac Thunderbird zoho e mail account issues

      I have issues with a user account on thunderbird e mail client who suddenly does not receive emails, when you click get messages we get an error "sending of password for user ......did not succeed, mail poppro.zoho.com responded service unavailable" after

    • PASSWORD

      Hello, I'm Joyce, my client used zoho for password sharing, he did share the canva but once I clicked on it it will not automatically log-in, instead I need to log-in again. My question is my boss log-in first to his gmail and use his gmail to log-in

    • Kaizen #195: Frequently Asked Questions on Bulk Read API and Bulk Write API

      🎊 Nearing 200th Kaizen Post – We want to hear from you! Do you have any questions, suggestions, or topics you would like us to cover in future posts? Your insights and suggestions help us shape future content and make this series better for everyone.

    • admin problem

      i can't to reach for the panel that i will create another mail to our company account i have admin access but i can't reach the panel our Company name Scale point my mail asmaa@dcalepointhub.com please can you help me Thanks

    • 554 5.7.1 : Recipient address rejected: user [username] does not exist

      Hi, I mistakenly altered my shopify email settings (where my domain is managed), but immediately reverted them, however now I have a strange email issue. I can send emails just fine, but cannot receive them. I have tried all troubleshooting steps but

    • Legit email address?

      Hello, I received emails from zohoadmin@biznetvigator.com with a password expiry notice. is that a legitimate email?

    • SMTP Authentication Fails with App Password – “535 Authentication Failed” Error

      Hello, I'm trying to send transactional emails from my WordPress website using the WP Mail SMTP plugin with Zoho Mail (smtp.zoho.com on port 465 with SSL). I've created and used a Zoho Mail app-specific password for SMTP, and verified that: The email

    • Deluge script issue : Mismatch of data type expression. Expected BIGINT but found STRING

      I'm building a Zoho Creator form to take inputs for Email, Bootcamp Name, and Tag. If a record with the same Email + Bootcamp exists in a custom module (bootcampattendence), I want to update it by adding a new tag. If it doesn’t exist, I want to create

    • Survey end date extension

      Hi, Is there any way to extend the end date of my survey? I needed more time in finding respondents that is why I need to extend the end date of my survey. Help. Thanks

    • Next Page