Get Access Token and Refresh Token

Use this endpoint to obtain an access token and a refresh token using an authorization code,
or to refresh an expired access token using a refresh token.

To get an access token (first time):
Set grant_type=authorization_code and provide the code parameter.

To refresh an access token:
Set grant_type=refresh_token and provide the refresh_token parameter.

Access tokens are valid for 1 hour.

Endpoint

post /oauth/v2/token

Copy full URL

Request URL

https://cpaas.zoho.com/v1.1/oauth/v2/token Copied!

Request Parameters

- Query Parameters

client_idstringMandatory

The Client ID generated from the Zoho API Console.

Example

1000.XXXXXXXXXXXX

client_secretstringMandatory

The Client Secret generated from the Zoho API Console.

Example

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

grant_typestringMandatory

The grant type. Use authorization_code for first-time token generation or refresh_token to refresh an expired token.

Example

authorization_code

Allowed Values :

Show Values ▾

codestringOptional

The authorization code generated from the Zoho API Console Self Client. Required when grant_type is authorization_code.

Example

1000.abc123xyz...

refresh_tokenstringOptional

The refresh token received during first-time token generation. Required when grant_type is refresh_token.

Example

1000.refresh.abc123xyz...

Sample Request

Curl

Java

Python

Deluge

Copied!

curl --request POST \
  --url 'https://cpaas.zoho.com/v1.1/oauth/v2/token?client_id=1000.XXXXXXXXXXXX&client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&grant_type=authorization_code&code=1000.abc123xyz...&refresh_token=1000.refresh.abc123xyz...' \
  --header 'Authorization: REPLACE_KEY_VALUE'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://cpaas.zoho.com/v1.1/oauth/v2/token?client_id=1000.XXXXXXXXXXXX&client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&grant_type=authorization_code&code=1000.abc123xyz...&refresh_token=1000.refresh.abc123xyz..."))
        .header("Authorization", "REPLACE_KEY_VALUE")
        .method("POST", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("cpaas.zoho.com")

headers = { 'Authorization': "REPLACE_KEY_VALUE" }

conn.request("POST", "/v1.1/oauth/v2/token?client_id=1000.XXXXXXXXXXXX&client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&grant_type=authorization_code&code=1000.abc123xyz...&refresh_token=1000.refresh.abc123xyz...", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    parameters = "client_id=value" + "&" + "client_secret=value" + "&" + "grant_type=value" + "&" + "code=value" + "&" + "refresh_token=value";

    headersMap = Map();
    headersMap.put("Authorization", "REPLACE_KEY_VALUE");
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://cpaas.zoho.com/v1.1/oauth/v2/token" + "?" + parameters
        type: POST
        headers: headersMap
        connection: connection_name
    ]

    info response;

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Show Sub-Attributes

access_tokenstringread-only

Example

1000.xxxx.xxxx

refresh_tokenstringread-only

Example

1000.yyyy.yyyy

api_domainstringread-only

Example

https://www.zohoapis.com

token_typestringread-only

Example

Bearer

expires_inintegerread-only

Example

3600

- HTTP code 400

Response Body - application/json

JSON Object

Show Sub-Attributes

errorstringread-only

Example

invalid_code

Sample Response: HTTP 200

Copied!

  {
    "access_token": "1000.xxxx.xxxx",
    "refresh_token": "1000.yyyy.yyyy",
    "api_domain": "https://www.zohoapis.com",
    "token_type": "Bearer",
    "expires_in": 3600
  }

▼ Show full

Sample Response: HTTP 400

Copied!

  {
    "error": "invalid_code"
  }

▼ Show full