The old-style Auth Token, generated by visiting a URL like accounts.zoho.com/apiauthtoken/create, has been deprecated across Zoho's APIs, including Zoho Projects. Authentication is now handled entirely through OAuth 2.0.

Step 1: Register Your Application

1. Go to the Zoho API Console and register a new client.
2. Choose a client type appropriate to your application (server-based, client-based, mobile/desktop, or self client for personal scripts).
3. On successful registration, you'll receive a Client ID and Client Secret.

Step 2: Get an Authorisation Code

Direct the user to Zoho's authorisation URL with the required parameters, for example:

https://accounts.zoho.com/oauth/v2/auth?scope=ZohoProjects.portals.READ,ZohoProjects.projects.ALL,ZohoProjects.tasks.READ&client_id={client_id}&response_type=code&access_type=offline&redirect_uri={redirect_uri}&prompt=consent

After the user consents, Zoho redirects back to your specified redirect URI with a code parameter, valid for only two minutes.

Step 3: Exchange the Code for Tokens

Use that code, along with your Client ID and Secret, to request an access token and refresh token from Zoho's token endpoint. The access token is valid for one hour, and the refresh token, which doesn't expire, lets you generate new access tokens without the user having to re-authorise each time.

Step 4: Use the Token

Pass the access token in the Authorization header of each API request, using the Zoho-specific Bearer format: Authorization: Zoho-oauthtoken {access_token}.

Choosing Scopes

Zoho Projects scopes follow a ZohoProjects.module.operation pattern, such as ZohoProjects.portals.READ or ZohoProjects.tasks.READ, letting you request only the specific access your integration genuinely needs, rather than broad account-wide access.