Zoho CRM doesn't use a single static API key. Instead, it uses OAuth 2.0, issuing short-lived access tokens and longer-lived refresh tokens that are scoped to specific permissions and can be revoked at any time.

Step 1: Register your client

1. Open the API Console. Go to the Zoho API Console for your data centre and sign in.
2. Choose a client type. Select Server-based Applications if your integration runs on a backend, or Self Client if you're testing without a hosted app, or building something that only needs to act on your own account without user-facing login.
3. Provide the details. Enter your Client Name, Homepage URL, and Authorized Redirect URI, then create the client. These details must exactly match what you use later when exchanging the authorization code.
4. Save your credentials. You'll be given a Client ID and Client Secret. Keep these private, since they authorise your app's requests.

Step 2: Generate a grant token

Using a Self Client, generate a grant token with the specific scopes your integration needs, such as read or write access to particular modules. This grant token is short-lived and used only once, to obtain your first access and refresh token pair.

Step 3: Exchange it for an access token and refresh token

Call the token endpoint on your data centre's accounts domain with your Client ID, Client Secret, and grant token. This returns an access token, valid for around 60 minutes, and a refresh token, which doesn't expire and is used to generate new access tokens once the current one runs out.

Step 4: Use the access token

Send the access token in your API request's Authorization header, formatted as Zoho-oauthtoken followed by the token itself. When it expires, use your refresh token to silently obtain a new one, without requiring the user to log in again.