OAuth 2.0
The standard authorisation protocol used to allow one application to access another application's API on behalf of a user, without sharing the user's password.
OAuth 2.0 is the industry-standard protocol for API authorisation. When you connect Zoho CRM to a third-party app, or authorise Zoho Flow to access your Google account, you are using OAuth 2.0. The protocol issues an access token to the requesting application after the user grants consent. The application uses this token for API calls, not the user's credentials. Access tokens expire; a refresh token allows the application to obtain new access tokens without requiring the user to log in again.
For Zoho API integrations, Zoho uses OAuth 2.0 as the authentication mechanism for all its REST APIs. The standard flows are: Authorization Code (for web applications where a user clicks 'Connect'), Client Credentials (for server-to-server integrations with no user in the loop), and PKCE (for mobile apps). SuiteTalk REST also uses OAuth 2.0.
A common integration failure point is token management: access tokens expire after one hour in most Zoho APIs. An integration that does not refresh tokens will work for an hour after setup and then silently fail. Aaxonix implements OAuth token refresh logic with persistent token storage as a standard pattern in all API integrations.
Related Terms
Need help implementing this in Zoho or NetSuite?
Aaxonix is a certified Zoho and NetSuite implementation partner based in Pune. Architecture-first, no surprises.
Book a Free Consultation →