Zoho Accounts OAuth 2.0

https://www.zoho.com/accounts/protocol/
Admin
Zoho Accounts OAuth 2.0 is an authentication and authorization protocol that enables third-party...
Tokens:16,289
Snippets:161
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Device Initiation Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/initiation-request.html

An example of a GET request to the device code endpoint with required query parameters.

```http
https://accounts.zoho.com/oauth/v3/device/code
?grant_type=device_request
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&scope=AaaServer.profile.Read
&access_type=offline
&prompt=consent
```

--------------------------------

### Authorization Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-authorization-code.html

A sample GET request URL including all required parameters for the authorization flow.

```http
https://accounts.zoho.com/oauth/v2/auth
?response_type=code
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&scope=AaaServer.profile.Read
&redirect_uri=https://www.zylker.com/oauthredirect
&code_challenge_method=S256
&code_challenge=cyBsZfGoX8dFwP-JVpT4U6MkDLrb8ZWGMdpBQtHsZPY
&access_type=offline
&prompt=consent
```

--------------------------------

### Authorization Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-token.html

A sample GET request to the authorization server including required parameters like client_id, scope, and redirect_uri.

```text
https://accounts.zoho.com/oauth/v2/auth
?response_type=token
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&scope=AaaServer.profile.Read
&redirect_uri=https://www.zylker.com/oauthredirect
```

--------------------------------

### Refresh Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-expiry.html

A sample GET request to the refresh endpoint including required query parameters.

```http
https://accounts.zoho.com/oauth/v2/auth/refresh
?response_type=token
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&redirect_uri=https://www.zylker.com/oauthredirect
&scope=AaaServer.profile.Read
```

--------------------------------

### Polling Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/polling-request.html

An example of a POST request to the token endpoint with required query parameters.

```http
https://accounts.zoho.com/oauth/v3/device/token
?client_id=1004.JNB00640KVIR87109F4XV941E2SY22
&client_secret=215734b0b2ca5f80f058a4be261e29cbbda609c2b6
&grant_type=device_token
&code=1004.71c4b3d036cbcc5ca5e6f26e4ac0ef11.3a141ff0e7fb15cbf8fc83113b10ec6e
```

--------------------------------

### Device Initiation Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/initiation-request.html

A sample JSON response containing the user code, device code, and verification URLs.

```json
{
"user_code": "ABCD-1234",
"device_code":"1004.c458057b370ec928086e679db8fbf15d.2dbe3e41e18b39e33236fb72ff3b1fd4”,
"interval": 5000,
"verification_uri_complete": "https://accounts.zoho.in/oauth/v3/device/setCode?devcode=XhyYgsfyO",
"expires_in": 300000,
"verification_url": "https://accounts.zoho.in/oauth/v3/device"
}
```

--------------------------------

### Scope Enhancement Response Examples

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/scope-enhance-request.html

Examples of success and failure redirect responses after the user grants or rejects the requested permissions.

```http
https://www.zylker.com/oauthredirect?status=success&scope_enhanced=true
```

```http
https://www.zylker.com/oauthredirect?error=access_denied
```

--------------------------------

### Scope Enhancement Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/initiation-request.html

An example of the URL structure for the scope enhancement request.

```http
https://accounts.zoho.in/oauth/v2/token/scopeenhance
?grant_type=update_scopes_token
&client_id=1000.HRLOVZ0U6LSAZ14OQHYZYTZBTL3SGR
&client_secret=fa10d952be6bd6654cbb6b5fe271042de9546541e781
&refresh_token=1000.0d50a4d6a383005cc1f899968b9f9d97.2183743f8798bea2f71e193e34e37ef0d
```

--------------------------------

### Scope Enhancement Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/scope-enhance-request.html

A sample request URL demonstrating the required query parameters for scope enhancement.

```http
https://accounts.zoho.in/oauth/v2/token/addextrascope
?response_type=update_scopes
&client_id=1000.HRLOVZ0544JSAZ14OQ1NHYHZBTL3SGR
&redirect_uri=https://zylker.com/oauthredirect
&scope=AaaServer.profile.Read,ZohoCliq.users.read,ZohoCRM.users.READ
&enhance_token=1000.e3b9859da1d36faf1e299889f6354da75.d83c513417fdfsdg514fb9ee38a6775fd50
&logout=true
```

--------------------------------

### Authorization Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-authorization-code.html

The redirect URL containing the authorization code and user location after successful consent.

```http
https://www.zylker.com/oauthredirect
?code=1000.a1110799eac53c491fee9efef8246535.df7da86ff64daa66413e2899e9b7fad7
&location=in
```

--------------------------------

### Authorization Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-token.html

The format of the redirect URL containing the access token and associated metadata after user consent.

```text
https://www.zylker.com/oauthredirect #access_token=1000.2350e7afbb173426e5fe3e5977db2f69.0cddd2403ee2e6309d44e7007bf21c05 &expires_in=3600 &location=in &api_domain=https://www.zohoapis.in &granted_for_session=true
```

--------------------------------

### Refresh Token Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/refresh-access-token.html

A sample JSON response containing the new access token and associated metadata.

```json
{
"access_token": "1004.ce70fccd3edf901d37859fe5124ae975.f61ca1a9d7979387cc02fb3f279",
"api_domain": "https://www.zohoapis.com",
"token_type": "Bearer",
"expires_in": 3600
}
```

--------------------------------

### Refresh Token Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/refresh-access-token.html

A sample HTTP request demonstrating the required query parameters for the refresh token flow.

```http
https://accounts.zoho.com/oauth/v2/token
?grant_type=refresh_token
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&client_secret=122c324d3496d5d7eeebc129470715fbb856b7
&refresh_token=1000.86a03ca5dbfccb7445889b8215efb0.cad1ae4989a1196fe05aa729fcb4e1
```

--------------------------------

### GET /oauth/serverinfo

Source: https://www.zoho.com/accounts/protocol/oauth/multi-dc.html

Retrieves the server URLs for all available data centers in JSON format.

```APIDOC
## GET /oauth/serverinfo

### Description
Retrieves the server URLs for all available data centers in JSON format.

### Method
GET

### Endpoint
https://accounts.zoho.com/oauth/serverinfo
```

--------------------------------

### Access Token Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/self-client/client-credentials-flow.html

A sample HTTP request demonstrating the required query parameters for the client credentials grant type.

```http
https://accounts.zoho.com/oauth/v2/token
?client_id=1000.O1xxxxxxxxxx5Q91NTGH
&client_secret=74xxxxxxxxxxxx180
&grant_type=client_credentials
&scope=ZohoCRM.settings.READ
&soid=ZohoCRM.600*****434
```

--------------------------------

### Sample Authorization Response for Client-based Apps

Source: https://www.zoho.com/accounts/protocol/oauth/multi-dc.html

Example of the redirect URL containing the access token, user location, and API domain.

```text
https://www.zylker.com/oauthredirect#  
&access_token=1000.835d578e9a2103d2e87994ae8752074d.4496b74ddde6413f83fe615e8388e488  
&expires_in=3600  
&location=in  
&api_domain=https://www.zohoapis.in
```

--------------------------------

### GET {accounts-server-url}/oauth/v2/auth

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-authorization-code.html

Request an authorization code from the authorization server to initiate the OAuth flow.

```APIDOC
## GET {accounts-server-url}/oauth/v2/auth

### Description
Request an authorization code from the authorization server. The user is prompted to grant permissions, and upon success, the code is sent to the provided redirect URI.

### Method
GET

### Endpoint
{accounts-server-url}/oauth/v2/auth

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **response_type** (string) - Required - Should be sent with the value 'code'.
- **redirect_uri** (string) - Required - The URI to which the authorization server will redirect the browser back with the authorization code.
- **scope** (string) - Required - The corresponding scope for the resource you want to access.
- **code_challenge_method** (string) - Required - The method used to transform the code_verifier into code_challenge (S256 or plain).
- **code_challenge** (string) - Required - A string generated when code_verifier is transformed.
- **access_type** (string) - Optional - Determines if the app can refresh the access token (online or offline).
- **prompt** (string) - Optional - If set to 'consent', the user will be prompted for consent every time.

### Request Example
https://accounts.zoho.com/oauth/v2/auth?response_type=code&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&scope=AaaServer.profile.Read&redirect_uri=https://www.zylker.com/oauthredirect&code_challenge_method=S256&code_challenge=cyBsZfGoX8dFwP-JVpT4U6MkDLrb8ZWGMdpBQtHsZPY&access_type=offline&prompt=consent

### Response
#### Success Response (Redirect)
- **code** (string) - The authorization code that can be exchanged for an access token.
- **location** (string) - Indicates the data center (DC) location of the user.

#### Response Example
https://www.zylker.com/oauthredirect?code=1000.a1110799eac53c491fee9efef8246535.df7da86ff64daa66413e2899e9b7fad7&location=in
```

--------------------------------

### Request Parameter Formats

Source: https://www.zoho.com/accounts/protocol/oauth/web-apps/access-token-expiry.html

Examples of different ways to provide request parameters, including query strings, request bodies, and basic authentication headers.

```text
https://accounts.zoho.com/oauth/v2/token?  
client_id=1000.QVF8O5MXFUYATAQGJKEWUXJKZH7OOE  
&grant_type=refresh_token  
&client_secret=31a99ae27deff7fr34e419fe321b712a02cdedted7  
&refresh_token=1000.3421ad0e1a6fe44663ea112b8b1c4fdf.cd38e645e3d7423651d17368855bc1c5
```

```text
client_id: "1000.QVF8O5MXFUYATAQGJKEWUXJKZH7OOE"  
client_secret: "31a99ae27deff7fr34e419fe321b712a02cdedted7"  
grant_type: "refresh_token"  
refresh_token: "1000.3421ad0e1a6fe44663ea112b8b1c4fdf.cd38e645e3d7423651d17368855bc1c5"
```

```text
Authorization: Basic MTAwMC5RVkY4TzVNWEZVWUFUQVFHSktFV1VYSktaSDdPT0U6MzFhOTlhZTI3ZGVmZjdmcjM0ZTQxOWZlMzIxYjcxMmEwMmNkZWR0ZWQ3
```

--------------------------------

### Revoke Token Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/revoke-refresh-token.html

A sample POST request to the revocation endpoint including the token as a query parameter.

```http
https://accounts.zoho.com/oauth/v2/token/revoke
?token=1000.18e983526f0ca8575ea9c53b0cd5bb58.1bd83a6f2e22c3a7e1309d96ae439cc1
```

--------------------------------

### Refresh Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-expiry.html

The format of the response redirected to the specified URI containing the new access token and metadata.

```http
https://www.zylker.com/oauthredirect #access_token=1000.2350e7afbb173426e5fe3e5977db2f69.0cddd2403ee2e6309d44e7007bf21c05 &expires_in=3600 &location=in &api_domain=https://www.zohoapis.in
```

--------------------------------

### Access Token Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/self-client/client-credentials-flow.html

A sample JSON response containing the access token, API domain, and expiration details.

```json
{
    "access_token": "1000.875cf8ea310ae70c6fb26e25a5a48df0.be3bc88ab282cd58c6fd32f110c53c61",
    "api_domain": "https://www.zohoapis.in",
    "token_type": "Bearer",
    "expires_in": 3600
}
```

--------------------------------

### GET {accounts-server-url}/oauth/v2/token/addextrascope

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/scope-enhance-request.html

Request to append additional scopes to a refresh token.

```APIDOC
## GET {accounts-server-url}/oauth/v2/token/addextrascope

### Description
Use this endpoint to append additional scopes to a refresh token by requesting user consent for the new permissions.

### Method
GET

### Endpoint
{accounts-server-url}/oauth/v2/token/addextrascope

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **response_type** (string) - Required - Should be sent with the value update_scopes.
- **redirect_uri** (string) - Required - The URI to which the authorization server will redirect the browser.
- **scope** (string) - Required - The list of additional scopes for the resource you want to access.
- **enhance_token** (string) - Required - The scope enhancement token received from the previous request.
- **logout** (boolean) - Required - If true, the user's session is terminated after granting/rejecting permission.

### Request Example
https://accounts.zoho.in/oauth/v2/token/addextrascope?response_type=update_scopes&client_id=1000.HRLOVZ0544JSAZ14OQ1NHYHZBTL3SGR&redirect_uri=https://zylker.com/oauthredirect&scope=AaaServer.profile.Read,ZohoCliq.users.read,ZohoCRM.users.READ&enhance_token=1000.e3b9859da1d36faf1e299889f6354da75.d83c513417fdfsdg514fb9ee38a6775fd50&logout=true

### Response
#### Success Response
- **status** (string) - Indicates success.
- **scope_enhanced** (boolean) - Indicates if the scope was successfully enhanced.

#### Failure Response
- **error** (string) - Indicates the reason for failure (e.g., access_denied).
```

--------------------------------

### Polling Success Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/devices/polling-request.html

The JSON response returned by the server upon successful authorization.

```json
{
"access_token": "1004.ce70fccd3edf901d37859fe5124ae975.f61ca1a9d7979387cc02fb3f279",
"refresh_token": "1004.7ed4fdccd7e68a9b898b6ba9538590af.f19b5b44251826323a5c2bae653fe7eb",
"api_domain": "https://www.zohoapis.com",
"token_type": "Bearer",
"expires_in": 3600
}
```

--------------------------------

### Token Exchange Request Example

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-access-token.html

A sample POST request using query parameters to exchange an authorization code for an access token.

```http
https://accounts.zoho.com/oauth/v2/token
?client_id=1000.GMB0YULZHJK411248S8I5GZ4CHUEX0
&client_secret=122c324d3496d5d777ceeebc129470715fbb856b7
&grant_type=authorization_code
&redirect_uri=https://www.zylker.com/oauthredirect
&code=1000.86a03ca5dbfccb7445b1889b8215efb0.cad9e1ae4989a1196fe05aa729fcb4e1
&code_verifier=wJJP-KJdoj2iF9ZvjJq9sxf2UgvjPpW_SqowzYsZr_o
```

--------------------------------

### GET {accounts-server-url}/oauth/v2/auth

Source: https://www.zoho.com/accounts/protocol/oauth/web-apps/authorization.html

Request an authorization code from the Zoho authorization server to initiate the OAuth flow.

```APIDOC
## GET {accounts-server-url}/oauth/v2/auth

### Description
Request for an authorization code from our authorization server. You will need to mention which scopes you need permission for. We will display the required permissions to the user. If the user grants permission, an authorization code will be sent to the redirect URL, which is valid for 2 minutes.

### Method
GET

### Endpoint
{accounts-server-url}/oauth/v2/auth

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **response_type** (string) - Required - Should be sent with the value code.
- **redirect_uri** (string) - Required - The URI to which the authorization server will redirect the browser back with the authorization code.
- **scope** (string) - Required - The corresponding scope for the resource you want to access.
- **access_type** (string) - Optional - Determines whether your app can refresh the access token on its own. Values: online, offline.
- **prompt** (string) - Optional - If included, the user will be prompted for consent every time. Value: consent.

### Request Example
https://accounts.zoho.com/oauth/v2/auth?response_type=code&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&scope=AaaServer.profile.Read&redirect_uri=https://www.zylker.com/oauthredirect&access_type=offline&prompt=consent

### Response
#### Success Response (Redirect)
- **code** (string) - The authorization code that can be exchanged for an access token.
- **location** (string) - Indicates the data center (DC) location of the user.

#### Response Example
https://oauth.pstmn.io/v1/browser-callback?code=1000.a1110799eac53c491fee9efef8246535.df7da86ff64daa66413e2899e9b7fad7&location=in&accounts-server=https://accounts.zoho.in
```

--------------------------------

### Token Exchange Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-access-token.html

The JSON response body containing the access token, refresh token, and associated metadata.

```json
{
"access_token":"1000.2deaf8d0c268e3c85daa2a013a843b10.703adef2bb337b8ca36cfc5d7b83cf24",
"refresh_token":"1000.18e983526f0ca8575ea9c53b0cd5bb58.1bd83a6f2e22c3a7e1309d96ae439cc1",
"api_domain":"https://api.zoho.com",
"token_type":"Bearer",
"expires_in":3600
}
```

--------------------------------

### Scope Enhancement Response Example

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/initiation-request.html

The JSON response structure returned upon a successful scope enhancement request.

```json
{
"access_token": "1000.f95a0db717f52b825e3f94654f651.ced2cf4e786cf04c0e91daee545jh51cd",
"token_type": "update_scope",
"expires_in": 600
}
```

--------------------------------

### GET {accounts-server-url}/oauth/v2/auth

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-token.html

Initiates the OAuth 2.0 authorization flow to request an access token for a specific set of scopes.

```APIDOC
## GET {accounts-server-url}/oauth/v2/auth

### Description
Request an access token from the authorization server. The user is prompted to grant permissions for the requested scopes, and upon approval, the access token is returned via the redirect URI.

### Method
GET

### Endpoint
{accounts-server-url}/oauth/v2/auth

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application from the API console.
- **response_type** (string) - Required - Must be set to 'token'.
- **redirect_uri** (string) - Required - The URI to which the authorization server redirects the browser with the access token. Must match the URI registered in the API console.
- **scope** (string) - Required - The scope for the resource you want to access.

### Request Example
https://accounts.zoho.com/oauth/v2/auth?response_type=token&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&scope=AaaServer.profile.Read&redirect_uri=https://www.zylker.com/oauthredirect

### Response
#### Success Response (Redirect)
- **access_token** (string) - Token used to access resources.
- **api_domain** (string) - The domain for making API requests.
- **location** (string) - The data center location of the user.
- **expires_in** (integer) - Token lifetime in seconds (3600).
- **granted_for_session** (boolean) - Indicates if the user granted permission to refresh the token.

#### Response Example
https://www.zylker.com/oauthredirect #access_token=1000.2350e7afbb173426e5fe3e5977db2f69.0cddd2403ee2e6309d44e7007bf21c05 &expires_in=3600 &location=in &api_domain=https://www.zohoapis.in &granted_for_session=true
```

--------------------------------

### Authorization Code Exchange Request

Source: https://www.zoho.com/accounts/protocol/oauth/self-client/authorization-code-flow.html

Example request to exchange an authorization code for an access token and refresh token.

```http
https://accounts.zoho.in/oauth/v2/token
?client_id=1000.XMDEG1KBDO9SE2IFTMDFSRPYYJ5L0U
&client_secret=1632308b34e2cf614fed922c5d6c4193c7778a5f13
&grant_type=authorization_code
&code=1000.406a3b53bad3f6824d4fb43108604cd7.a74aef3010243f0fae78111e2a673847
```

--------------------------------

### Access Token Request for EU Data Center

Source: https://www.zoho.com/accounts/protocol/oauth/multi-dc.html

Example of an access token request directed to the EU data center server URL after identifying the user's location.

```text
https://accounts.zoho.eu/oauth/v2/token  
?client_id=1000.GMB0YULZHJK411248S8I5GZ4CHUEX0  
&grant_type=authorization_code  
&client_secret=122c324d3496d5d777ceeebc129470715fbb856b7  
&redirect_uri=https://www.zylker.com/oauthredirect  
&code=1000.86a03ca5dbfccb7445b1889b8215efb0.cad9e1ae4989a1196fe05aa729fcb4e1
```

--------------------------------

### Non-browser Application Feedback and Response

Source: https://www.zoho.com/accounts/protocol/oauth/multi-dc.html

Examples of the error feedback when a user is in a different DC and the subsequent successful token response.

```json
{
user_location": "eu",  
"error": "other_dc"
}
```

```json
{
access_token": "1004.a3fdad1f7115c8d00a491938a3650a2f.68485f81304",  
"api_domain": "https://api.zoho.com",  
"token_type": "Bearer",  
"expires_in":3600  
}
```

--------------------------------

### GET {accounts-server-url}/oauth/v2/auth/refresh

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-expiry.html

Requests a new access token using the refresh flow. This endpoint requires that the user previously granted permission for the app to refresh the token and that the session remains active.

```APIDOC
## GET {accounts-server-url}/oauth/v2/auth/refresh

### Description
Obtains a new access token without user intervention if the session is active and permission was granted.

### Method
GET

### Endpoint
{accounts-server-url}/oauth/v2/auth/refresh

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **response_type** (string) - Required - Should be sent with the value 'token'.
- **redirect_uri** (string) - Required - The URI to which the authorization server will redirect the browser back with the access token.
- **scope** (string) - Required - The scopes to include in the new access token. Only previously granted scopes are allowed.

### Request Example
https://accounts.zoho.com/oauth/v2/auth/refresh?response_type=token&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&redirect_uri=https://www.zylker.com/oauthredirect&scope=AaaServer.profile.Read

### Response
#### Success Response (200)
- **access_token** (string) - A token used to access resources.
- **api_domain** (string) - The domain for making API requests.
- **location** (string) - The data center location of the user.
- **expires_in** (integer) - Time in seconds until the token expires (3600).

#### Response Example
https://www.zylker.com/oauthredirect #access_token=1000.2350e7afbb173426e5fe3e5977db2f69.0cddd2403ee2e6309d44e7007bf21c05 &expires_in=3600 &location=in &api_domain=https://www.zohoapis.in
```

--------------------------------

### POST {accounts-server-url}/oauth/v3/device/code

Source: https://www.zoho.com/accounts/protocol/oauth/devices/initiation-request.html

Initiates the device authorization flow to obtain codes and URLs for user consent.

```APIDOC
## POST {accounts-server-url}/oauth/v3/device/code

### Description
Get the device code, user code, and verification URL from the Zoho Accounts server, which are needed to get the permission from the user and to make the polling request.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v3/device/code

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **grant_type** (string) - Required - Should be sent with the value device_request.
- **scope** (string) - Required - The corresponding scope for the resource you want to access.
- **access_type** (string) - Optional - Determines whether your app can refresh the access token. Values: online, offline.
- **prompt** (string) - Optional - If included, the user will be prompted for consent every time. Value: consent.

### Request Example
https://accounts.zoho.com/oauth/v3/device/code?grant_type=device_request&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&scope=AaaServer.profile.Read&access_type=offline&prompt=consent

### Response
#### Success Response (200)
- **user_code** (string) - A unique code that user should enter in a browser.
- **device_code** (string) - A unique code used to identify the device.
- **interval** (integer) - The time duration in milliseconds to wait between polling requests.
- **expires_in** (integer) - The validity of the device_code in milliseconds.
- **verification_url** (string) - The URL the user must navigate to in a browser.
- **verification_uri_complete** (string) - The verification_url with the device_code appended.

#### Response Example
{
"user_code": "ABCD-1234",
"device_code": "1004.c458057b370ec928086e679db8fbf15d.2dbe3e41e18b39e33236fb72ff3b1fd4",
"interval": 5000,
"verification_uri_complete": "https://accounts.zoho.in/oauth/v3/device/setCode?devcode=XhyYgsfyO",
"expires_in": 300000,
"verification_url": "https://accounts.zoho.in/oauth/v3/device"
}
```

--------------------------------

### Device Initiation Endpoint

Source: https://www.zoho.com/accounts/protocol/oauth/devices/initiation-request.html

The POST endpoint used to initiate the device authorization flow.

```http
POST         {accounts-server-url}/oauth/v3/device/code
```

--------------------------------

### Sample Authorization Response

Source: https://www.zoho.com/accounts/protocol/oauth/multi-dc.html

The authorization response includes the user's location and the corresponding accounts server URL, which are used to determine the correct DC for subsequent requests.

```text
https://oauth.pstmn.io/v1/browser-callback  
?code=1000.abbb4c9e0902704b90cc556f32ec0336.5ff4478926a43657280d5cbe1af1917a  
&location=in  
&accounts-server=https://accounts.zoho.in
```

--------------------------------

### POST {accounts-server-url}/oauth/v2/token

Source: https://www.zoho.com/accounts/protocol/oauth/devices/refresh-access-token.html

Use this endpoint to exchange a refresh token for a new access token. The request must be sent as a POST request with the required parameters in the query string.

```APIDOC
## POST {accounts-server-url}/oauth/v2/token

### Description
Use the refresh token to generate another access token for the same set of scopes. Your app can create up to ten access tokens in a span of ten minutes.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v2/token

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **client_secret** (string) - Required - The unique secret for your app.
- **grant_type** (string) - Required - Must be set to 'refresh_token'.
- **refresh_token** (string) - Required - The refresh token received after the polling request.

### Request Example
https://accounts.zoho.com/oauth/v2/token?grant_type=refresh_token&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0&client_secret=122c324d3496d5d7eeebc129470715fbb856b7&refresh_token=1000.86a03ca5dbfccb7445889b8215efb0.cad1ae4989a1196fe05aa729fcb4e1

### Response
#### Success Response (200)
- **access_token** (string) - A token that your app needs to access the resources.
- **api_domain** (string) - The domain to which your app needs to make API requests.
- **token_type** (string) - Indicates the type of access token (Bearer).
- **expires_in** (integer) - Indicates the time in seconds in which the access token expires.

#### Response Example
{
"access_token": "1004.ce70fccd3edf901d37859fe5124ae975.f61ca1a9d7979387cc02fb3f279",
"api_domain": "https://www.zohoapis.com",
"token_type": "Bearer",
"expires_in": 3600
}
```

--------------------------------

### Authorization Header Syntax

Source: https://www.zoho.com/accounts/protocol/oauth/web-apps/access-token.html

The required format for sending the access token in API requests.

```http
Authorization: Bearer {access token}
```

--------------------------------

### POST {accounts-server-url}/oauth/v3/device/token

Source: https://www.zoho.com/accounts/protocol/oauth/devices/polling-request.html

Exchanges the device code for an access token. The request must be sent to the accounts-server-url specific to the datacenter where the app is registered.

```APIDOC
## POST {accounts-server-url}/oauth/v3/device/token

### Description
Get the access token from the Zoho Accounts server by exchanging the device code.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v3/device/token

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **client_secret** (string) - Required - The unique secret for your app.
- **grant_type** (string) - Required - Should be sent with the value device_token.
- **code** (string) - Required - The device_code received after the initiation request.

### Request Example
https://accounts.zoho.com/oauth/v3/device/token?client_id=1004.JNB00640KVIR87109F4XV941E2SY22&client_secret=215734b0b2ca5f80f058a4be261e29cbbda609c2b6&grant_type=device_token&code=1004.71c4b3d036cbcc5ca5e6f26e4ac0ef11.3a141ff0e7fb15cbf8fc83113b10ec6e

### Response
#### Success Response (200)
- **access_token** (string) - A token that your app needs to access the resources.
- **refresh_token** (string) - Optional - A token used to refresh the access token.
- **api_domain** (string) - The domain to which your app needs to make API requests.
- **token_type** (string) - Indicates the type of access token (Bearer).
- **expires_in** (integer) - The time in seconds in which the access token expires.

#### Response Example
{
"access_token": "1004.ce70fccd3edf901d37859fe5124ae975.f61ca1a9d7979387cc02fb3f279",
"refresh_token": "1004.7ed4fdccd7e68a9b898b6ba9538590af.f19b5b44251826323a5c2bae653fe7eb",
"api_domain": "https://www.zohoapis.com",
"token_type": "Bearer",
"expires_in": 3600
}
```

--------------------------------

### POST {accounts-server-url}/oauth/v2/token/scopeenhance

Source: https://www.zoho.com/accounts/protocol/oauth/incremental-auth/initiation-request.html

Requests a scope enhancement token to append additional scopes to a refresh token.

```APIDOC
## POST {accounts-server-url}/oauth/v2/token/scopeenhance

### Description
Get a scope enhancement token from the authorization server. You will need to send a refresh token to which the additional scopes are to be appended.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v2/token/scopeenhance

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **client_secret** (string) - Required - The unique secret for your app.
- **grant_type** (string) - Required - Must be set to 'update_scopes_token'.
- **refresh_token** (string) - Required - The refresh token to which the additional scopes are to be appended.

### Request Example
https://accounts.zoho.in/oauth/v2/token/scopeenhance?grant_type=update_scopes_token&client_id=1000.HRLOVZ0U6LSAZ14OQHYZYTZBTL3SGR&client_secret=fa10d952be6bd6654cbb6b5fe271042de9546541e781&refresh_token=1000.0d50a4d6a383005cc1f899968b9f9d97.2183743f8798bea2f71e193e34e37ef0d

### Response
#### Success Response (200)
- **access_token** (string) - The scope enhancement token.
- **token_type** (string) - The type of token generated.
- **expires_in** (integer) - The time in seconds until the token expires.

#### Response Example
{
"access_token": "1000.f95a0db717f52b825e3f94654f651.ced2cf4e786cf04c0e91daee545jh51cd",
"token_type": "update_scope",
"expires_in": 600
}
```

--------------------------------

### POST {accounts-server-url}/oauth/v2/token

Source: https://www.zoho.com/accounts/protocol/oauth/mobile-and-desktop-apps/get-access-token.html

Exchanges an authorization code for an access token.

```APIDOC
## POST {accounts-server-url}/oauth/v2/token

### Description
Exchanges the authorization code received from the authorization server for an access token.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v2/token

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique ID of your application.
- **client_secret** (string) - Required - The unique secret for your app.
- **grant_type** (string) - Required - Must be set to 'authorization_code'.
- **code** (string) - Required - The authorization code received after the authorization request.
- **redirect_uri** (string) - Required - The URI provided when registering the app.
- **code_verifier** (string) - Required - A cryptographically-generated random string.

### Request Example
https://accounts.zoho.com/oauth/v2/token?client_id=1000.GMB0YULZHJK411248S8I5GZ4CHUEX0&client_secret=122c324d3496d5d777ceeebc129470715fbb856b7&grant_type=authorization_code&redirect_uri=https://www.zylker.com/oauthredirect&code=1000.86a03ca5dbfccb7445b1889b8215efb0.cad9e1ae4989a1196fe05aa729fcb4e1&code_verifier=wJJP-KJdoj2iF9ZvjJq9sxf2UgvjPpW_SqowzYsZr_o

### Response
#### Success Response (200)
- **access_token** (string) - Token used to access resources.
- **refresh_token** (string) - Token used to refresh the access token.
- **api_domain** (string) - The domain for API requests.
- **token_type** (string) - The type of token (Bearer).
- **expires_in** (integer) - Expiration time in seconds.

#### Response Example
{
  "access_token": "1000.2deaf8d0c268e3c85daa2a013a843b10.703adef2bb337b8ca36cfc5d7b83cf24",
  "refresh_token": "1000.18e983526f0ca8575ea9c53b0cd5bb58.1bd83a6f2e22c3a7e1309d96ae439cc1",
  "api_domain": "https://api.zoho.com",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

--------------------------------

### POST {accounts-server-url}/oauth/v2/token

Source: https://www.zoho.com/accounts/protocol/oauth/self-client/client-credentials-flow.html

Exchanges client credentials for an access token to be used in subsequent API requests.

```APIDOC
## POST {accounts-server-url}/oauth/v2/token

### Description
Exchanges client credentials for an access token to be used in subsequent API requests.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v2/token

### Parameters
#### Query Parameters
- **client_id** (string) - Required - A unique ID displayed under Self Client > Client Secret.
- **client_secret** (string) - Required - A unique confidential secret displayed under Self Client > Client Secret.
- **grant_type** (string) - Required - Should be passed with the value client_credentials.
- **scope** (string) - Required - The corresponding scope for the resource you want to access.
- **soid** (string) - Required (for certain apps) - The unique ID of the app's instance (e.g., {servicename}.{zsoid}).

### Request Example
https://accounts.zoho.com/oauth/v2/token?client_id=1000.O1xxxxxxxxxx5Q91NTGH&client_secret=74xxxxxxxxxxxx180&grant_type=client_credentials&scope=ZohoCRM.settings.READ&soid=ZohoCRM.600*****434

### Response
#### Success Response (200)
- **access_token** (string) - An authorized key used to access the required resource.
- **api_domain** (string) - The domain the app needs to make service API requests to.
- **token_type** (string) - Indicates the type of access token (Bearer).
- **expires_in** (integer) - Time in seconds in which the access token will expire.

#### Response Example
{
    "access_token": "1000.875cf8ea310ae70c6fb26e25a5a48df0.be3bc88ab282cd58c6fd32f110c53c61",
    "api_domain": "https://www.zohoapis.in",
    "token_type": "Bearer",
    "expires_in": 3600
}
```

--------------------------------

### POST {accounts-server-url}/oauth/v2/token (Exchange Authorization Code)

Source: https://www.zoho.com/accounts/protocol/oauth/self-client/authorization-code-flow.html

Exchanges an authorization code for an access token and a refresh token.

```APIDOC
## POST {accounts-server-url}/oauth/v2/token

### Description
Exchanges the authorization code generated in the console for an access token and a refresh token.

### Method
POST

### Endpoint
{accounts-server-url}/oauth/v2/token

### Parameters
#### Query Parameters
- **client_id** (string) - Required - A unique ID displayed under Self Client > Client Secret.
- **client_secret** (string) - Required - A unique confidential secret displayed under Self Client > Client Secret.
- **grant_type** (string) - Required - Should be passed with the value authorization_code.
- **code** (string) - Required - The authorization code generated in the previous step.

### Request Example
https://accounts.zoho.in/oauth/v2/token?client_id=1000.XMDEG1KBDO9SE2IFTMDFSRPYYJ5L0U&client_secret=1632308b34e2cf614fed922c5d6c4193c7778a5f13&grant_type=authorization_code&code=1000.406a3b53bad3f6824d4fb43108604cd7.a74aef3010243f0fae78111e2a673847

### Response
#### Success Response (200)
- **access_token** (string) - An authorized key used to access the required resource.
- **refresh_token** (string) - A special token used to refresh the access token once it is expired.
- **api_domain** (string) - The domain the app needs to make service API requests to.
- **token_type** (string) - Indicates the type of access token (Bearer).
- **expires_in** (integer) - Time in seconds in which the access token will expire.

#### Response Example
{
    "access_token": "1000.875cf8ea310ae70c6fb26e25a5a48df0.be3bc88ab282cd58c6fd32f110c53c61",
    "refresh_token": "1000.ce79a5110c4097744b17aecbb95dcfeb.db3167fy73ca0082fa4f6182474fc80e",
    "api_domain": "https://www.zohoapis.in",
    "token_type": "Bearer",
    "expires_in": 3600
}
```

--------------------------------

### Access Token Throttle Exception Response

Source: https://www.zoho.com/accounts/protocol/oauth/token-limits.html

The JSON structure returned when the 10-request-per-10-minute limit for access tokens is exceeded.

```json
{
"error_description": "You have made too many requests continuously. Please try again after some time.",
"error": "Access Denied"
}
```

--------------------------------

### Authorization Endpoint

Source: https://www.zoho.com/accounts/protocol/oauth/js-apps/access-token.html

The base URL for the authorization request. Replace {accounts-server-url} with the datacenter-specific URL for your application.

```text
GET	 	{accounts-server-url}/oauth/v2/auth
```
Tokens:
Raw