OAuth

OAuth 2.0 in Zoho Payments allows third-party applications to securely access user data without sharing passwords. It uses access tokens for limited, time-bound access to specific resources, ensuring that only trusted apps can interact with Zoho Payments. You can generate an OAuth token to authenticate API calls at the organization level. This provides secure, centralized access to resources across your organization using a single client setup.

1. Register a New Client

To begin, register your application in the Zoho’s Developer Console to obtain your Client ID and Client Secret.

To register your application:

1. Go to the Zoho Zoho's Developer Console and ensure that the client type is set to ORG in the URL.
2. Enter the Client Name, Homepage URL, and the Authorized Redirect URIs.

3. Click Create.

   

Your Client ID and Client Secret will be generated. You can access them from the Client Secret tab in the Zoho Developer Console.

2. Generate an Authorization Code

Once you have the client credentials, make a GET request to generate the authorization url to retrieve the authorization_code. Use the following request URL add the parameters listed below to complete the request.

• Method: GET
• Request URL: https://accounts.zoho.com/oauth/v2/org/auth

1. Compose the request URL using the following parameters.

* Indicates mandatory fields.

Scopes in Zoho Payments:

Once this authorization URL is composed, your request will look like this:

https://accounts.zoho.com/oauth/v2/org/auth?scope=ZohoPay.payments.CREATEe&client_id=1005xxxxxxxxxxxxxxxxxxxxxxxxx&soidzohopay.8xxxxxxxx3&state=xxxxxxxx&response_type=code&redirect_uri=https://www.zylker.com/&access_type=offline

2. Copy and paste the GET URL in your browser. This will list the account for which you want to grant access.

3. Click Accept to grant access to your Zoho Payments account data.

   

After granting access, you’ll be redirected to the specified Redirect URI. You can retrieve the authorization_code from the code parameter, along with other parameters.

https://www.zylker.com/?state=xxxxxxx&code=1005.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc&location=us&accounts-server=https%3A%2F%2Faccounts.zoho.com

3. Generate Access and Refresh Tokens

Once you have the authorization, make a POST request with the required parameters to generate an access_token. Use the following URL: https://accounts.zoho.com/oauth/v2/token?

* Indicates mandatory fields.

The response to your request will include both an access_token and a refresh_token :

1. access_token: Expires after a certain period, as indicated by the expires_in parameter in the response.
2. refresh_token: Permanent and can be used to generate a new access_token once the current one expires.

https://accounts.zoho.com/oauth/v2/token?code=1000.dd7exxxxxxxxxxxxxxxxxxxxxxxx9bb8.b6c0xxxxxxxxxxxxxxxxxxxxxxxxdca4&client_id=1000.0SRSxxxxxxxxxxxxxxxxxxxx239V&client_secret=fb01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8abf&redirect_uri=https://www.zylker.com/&grant_type=authorization_code

4. Call an API

When calling an API, the access token must be included in the request header and cannot be passed as a request parameter.

• Header Name: Authorization
• Header Value: Zoho-oauthtoken {access_token}

5. Generate Access Tokens from Refresh Tokens

Access tokens have limited validity, typically expiring in one hour, but can be used without restriction during this time. Once an access token expires, your application must use the refresh token to obtain a new access token.

To generate a new access token, make a POST request with the given parameters to the following URL: https://accounts.zoho.com/oauth/v2/token?

* Indicates mandatory fields.

https://accounts.zoho.com/oauth/v2/token?refresh_token=1000.8ecdxxxxxxxxxxxxxxxxxxxxx5cb7.4638xxxxxxxxxxxxxxxxxxxxxxebdc&client_id=1000.0SRSxxxxxxxxxxxxxxxxxxxx239V&client_secret=fb01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8abf&grant_type=refresh_token

6. Revoke Refresh Token

To revoke a refresh token, make a POST request with the given parameters to the following URL: https://accounts.zoho.com/oauth/v2/token/revoke?

https://accounts.zoho.com/oauth/v2/token/revoke?token=1000.8ecdxxxxxxxxxxxxxxxxxxxxxxxx5cb7.4638xxxxxxxxxxxxxxxxxxxxxxxxebdc

Your refresh tokens have now been revoked, and you can’t use them to generate new access tokens to initiate API calls

If you wish to generate tokens again, you will need to repeat the entire process.