Reading through the theory of Zoho CRM's OAuth 2.0 flow is one thing, seeing it done with real command syntax is another. This worked example walks through registering a test client, generating a token, and making a first authenticated request, using a developer building a small script to pull recent Leads as the scenario.
A developer on the India data centre wants a script that reads Lead records, without a hosted app or a user-facing login screen. A Self Client is the right choice here, since it is designed for exactly this kind of account-level access.
In the Zoho API Console for the India data centre, a new Self Client is created, producing a Client ID and Client Secret. These two values authorise every request that follows, so they are stored as environment variables rather than written directly into the script.
From the Self Client screen, a grant token is generated with a scope limited to what the script actually needs, in this case read-only access to Leads:
The grant token is exchanged for an access token and refresh token by calling the token endpoint on the India accounts domain:
A successful call returns a JSON response similar to this, with the real token values replaced here for illustration:
With the access token in hand, the script requests the most recently modified Leads:
The same request works identically inside Postman: set the method to GET, the URL to the endpoint above, and add the Authorization header under the Headers tab rather than using Postman's separate OAuth 2.0 auth type, which is built around a different, browser-based flow.