there a couple of details that deserve clarification / improvement in Zoho's OAuth 2:

1. for building true server apps - cloud to cloud REST - one has to choose Self Client when creating a new instance in API Console; Server-based Appplications is slightly misleading as it has mandatory client stuff such as redirect URL which is not required in server apps

2. hence we have to go with self client - but I can only create one pair of id/secret which makes it vulnerable and limiting. I understand I can generate unlimited refresh tokens with dedicated scopes but still, I'd prefer using separate multiple self clients for separate environments

please correct me if I am wrong in point 1 and it is possible to build backend apps with a different client type? (on a related note, I do believe OAuth is an overkill for these kind of connections and the API would be better off with just one long lived token and without short lived access token needing a regeneration; this is a separate topic raised in  https://help.zoho.com/portal/en/community/topic/auth-type-apikey-for-crm-rest though)

re point 2 - please accept this as feature request suggestion.