How to Create OAuth Credentials for Zoho CRM

This guide will help you set up your Zoho CRM OAuth app to connect with Apideck.

Zoho CRM is a comprehensive customer relationship management platform that helps businesses manage sales, marketing, and customer support. Integrating Zoho CRM into your application allows you to access leads, contacts, deals, accounts, and other CRM data through Apideck's unified API.

Prerequisites

Before you begin, make sure you have:

1. A Zoho account with access to Zoho CRM
2. An Apideck account
3. A Zoho account that can sign in to the Zoho API Console (client registration is self-service; no administrator approval is involved)

Who can authorize a connection: every consumer who connects needs a Zoho CRM profile that carries the Zoho CRM API Access permission, found under Setup > Security Control > Profiles > Developer Permissions in their own Zoho CRM organization. Administrators have this permission by default; other profiles may need a Zoho CRM administrator to enable it before the consumer can authorize.

Enable the Zoho CRM Connector in Apideck

1. Navigate to the Apideck Dashboard
2. Enable the Zoho CRM connector if it's not already enabled

Getting Your OAuth Credentials

Step 1: Sign in to Zoho API Console

1. Go to https://api-console.zoho.com/
2. Sign in with your Zoho account credentials

Step 2: Create a New OAuth Application

1. On the applications overview page, click the "Add client" button in the top right corner

2. Select "Server-based Applications" as the client type

Step 3: Configure Application Details

Fill in the application details form:

• Client Name: Enter a descriptive name (e.g., "Apideck Integration"). This name will be shown to users when they authorize your app to access their Zoho CRM account.
• Client Type: Should be set to "Server-based Applications" (selected in the previous step).
• Homepage URL: Enter your company's website URL or your SaaS product URL.
• Authorized Redirect URIs:

https://unify.apideck.com/vault/callback

💡 TIP: The redirect URI must match exactly. Make sure there are no trailing slashes or extra characters.

Step 4: Get Your Client Credentials

After creating the application, Zoho will display your OAuth 2.0 credentials:

You'll see:

• Client ID: A unique identifier for your application
• Client Secret: A secret key used for authentication

💡 TIP: Copy the Client ID and Client Secret immediately. The Client Secret may only be visible once when you first create the app. If you lose it, you'll need to regenerate it.

Step 5: Enable the Data Centers Your Consumers Use

Zoho runs nine separate data centers (US, EU, India, Australia, Japan, China, Canada, Saudi Arabia and the UK), and every Zoho CRM organization lives in exactly one of them. Your client only exists in the data centers you enable here, so a consumer whose organization sits in a data center you did not enable cannot authorize the connection. Enabling all the regions your customers operate in is the single most important step in this guide.

1. Click on "Settings" for your newly created application
2. Enable every data center where your customers' Zoho CRM accounts are hosted
3. Click "Use the same OAuth credentials for all data centers" to use one Client Secret across all enabled data centers (the Client ID is the same everywhere regardless)

💡 TIP: Your consumers never choose a data center and never enter one in Vault. The connector detects each consumer's Zoho accounts server and API domain from the OAuth callback and routes their API calls accordingly. Your only job is to make sure the client is enabled in the right data centers up front.

Configure in Apideck

Now that you have your Zoho CRM OAuth credentials, configure them in Apideck:

1. Navigate to Apideck Dashboard > Configuration > CRM > Zoho CRM

2. Enter your OAuth credentials:

   • Client ID → client_id: Paste the Client ID from your Zoho application
   • Client Secret → client_secret: Paste the Client Secret from your Zoho application

3. Configure Scopes: We recommend setting these three scopes:

• ZohoCRM.modules.ALL: Full access to all Zoho CRM modules and operations
• ZohoCRM.users.ALL: Full access to user information
• ZohoCRM.settings.fields.READ: Read access to Zoho CRM module fields

Zoho attaches scopes at authorization time rather than to the client itself, so the list you save here is exactly what your consumers see on the Zoho consent screen.

4. Click "Save settings" to save your credentials and scopes

Refresh Token Limits

Zoho stores a maximum of 20 refresh tokens per Zoho user per client. When the same user authorizes your client for the 21st time, Zoho silently invalidates the oldest refresh token, which breaks whichever connection was holding it. Refresh tokens do not otherwise expire; they stay valid until they are revoked.

This most often shows up during repeated testing with a single Zoho account, but any Zoho user who re-authorizes many times can hit it. Spread your own testing across Zoho accounts rather than re-authorizing the same one, and tell consumers who report a dropped connection to authorize again.

Hand Over to Your Consumers

Authorizing the connection is the consumer's step, not yours: they click Authorize in Vault, sign in to Zoho, pick their Zoho CRM organization and accept the scopes you configured above. The full walkthrough, including the profile permission they need and what to check when authorization fails, is in the Connection Guide.

To try it yourself before handing it over, open Test Vault from the Apideck Dashboard and run through the same authorization flow with a Zoho CRM account of your own.

FAQ and Troubleshooting

A consumer gets an error instead of the Zoho consent screen. Check that the client is enabled for their data center (Step 5) and that the redirect URI on the client is exactly https://unify.apideck.com/vault/callback.

A consumer reaches the consent screen but the connection does not become callable. Confirm their Zoho CRM profile has the Zoho CRM API Access permission, and that the scopes saved in the Apideck Dashboard match the three listed above.

A previously working connection stopped without any change on your side. If the same Zoho user has authorized your client many times, the 20 refresh token cap may have invalidated the oldest token. Reauthorizing that connection restores it.

Still stuck? Reach out to Apideck Support.