OAuth 2.0 workflow AI Tools

Open in ChatGPT

Open in ChatGPT to ask questions about this page

Open in Claude

Open in Claude to ask questions about this page

Copy as Markdown

Copy this page as markdown to use with AI assistants

View as Markdown

Open this page as markdown in a new tab

Step 1: Register your app and get OAuth credentials

The first step in using OAuth authentication is registering your app with the Zoho API console. Once you register your client, you will get a Client ID and Client secret for your application. This Client ID and Client secret are used to authorize your app's OAuth requests.

Step 2: Obtain an access token

An access token is an OAuth token that allows access to Zoho's protected resources. The method for generating an access token depends on the type of application. For instance, server-based applications can use the authorization code flow, while client-based applications can utilize the implicit flow. However, in all cases, the access token is provided only after the user grants permission through consent. Access tokens are always assigned specific scopes, which are outlined in the request, and these scopes will be presented to the user during the permission request process.

Generate auth code (required once)

GET https://accounts.zoho.{dc}/oauth/v2/auth \
  ?scope=ZohoCliq.Channels.READ \
  &client_id={client_id} \
  &response_type=code \
  &access_type=offline \
  &prompt=consent \
  &redirect_uri={redirect_uri}

Generate access token + refresh token

curl --request POST \
  --url 'https://accounts.zoho.{dc}/oauth/v2/token' \
  --data 'grant_type=authorization_code' \
  --data 'client_id={client_id}' \
  --data 'client_secret={client_secret}' \
  --data 'redirect_uri={redirect_uri}' \
  --data 'code={authorization_code}'

Response fields to store: access_token, refresh_token, expires_in.

Step 3: Access the resource using the access token

After your app has the access token, it can access Zoho's protected resources. Upon providing the access token to the resource server, your app will be granted access according to the scopes defined in the request. Zoho's OAuth implementation uses the Bearer authentication scheme; hence, when making API calls, the access token must be passed in the Authorization header with the prefix "Zoho-oauthtoken".

Step 4: Refresh the access token when it expires

Access tokens are valid for 1 hour. Use the stored refresh token to generate a new access token.

curl --request POST \
  --url 'https://accounts.zoho.{dc}/oauth/v2/token' \
  --data 'grant_type=refresh_token' \
  --data 'client_id={client_id}' \
  --data 'client_secret={client_secret}' \
  --data 'refresh_token={refresh_token}'

Step 5: Revoke unwanted tokens

If a refresh token is no longer needed or seems to be compromised, it can be revoked and rendered invalid. This is done by making an API request. Once the revocation is successful, the refresh token can no longer be used to generate access tokens, and any existing access tokens that were created using this refresh token will also become invalid.