Authorization Request

To use the Zoho Recruit APIs, the users must authenticate the application to make API calls on their behalf with an access token.

The access token, in return, must be obtained from a grant token (authorization code). The Zoho Recruit APIs use the authorization code grant type to provide access to protected resources.

There are two ways in which you can generate the grant token based on the client type.

• Web-based application
• Self-client

Web-based application

Web-based applications are chosen when your application is used by multiple users and requires user intervention during authorization. For this client type, you must use redirection-based code generation. In this authorization flow,

• The web application redirects the user to the Zoho OAuth server with the required scope in the Accounts URL:

  "https://accounts.zoho.com/oauth/v2/auth?scope=ZohoRecruit.users.ALL&client_id={client_id}&response_type=code&access_type={"offline"or"online"}&redirect_uri={redirect_uri}"

  As you can see, the request URL has the parameters "scope", "client_id", "response_type", "access_type", and "redirect_uri".

  Parameter	Description
  scope	Data that your application wants to access. Refer to Scopes for more details.
  client_id	Client ID(consumer key) that you obtained during client registration.
  redirect_uri	Callback URL that you specified during client registration.
  response_type	Enter code.
  access_type	Enter access_type as online or offline. If you want to generate the refresh token, set this value as offline.
  prompt=consent	To generate refresh token.

  Based on the user's login details, the system automatically detects the user's domain and uses the domain-specific authentication URL to obtain the grant token (code).

• When the user clicks Accept: The application gets authorized. The grant token sent as a parameter in the redirect_uri.
  
• A back-end script from your end needs to store the following details from the above URL.
  • code={grant_token} - This is used to generate access and refresh tokens.
  • location={domain} - This tells you the domain of the user from which you have to make API calls.
  • accounts-server={accounts_URL} - This is your accounts URL which you have to use to generate access and refresh tokens.
• The application exchanges the authorization code for an access token.
• When the user clicks Reject: The browser redirects to the redirect URI with the parameter error=access_denied, and your application is denied access to the user's data in Zoho Recruit.

Possible Errors

Self-Client option

Use this method to generate the grant token if your application does not have a domain and a redirect URL.
You can also use this option when your application is a standalone server-side application performing a back-end job.

1. Go to Zoho Developer Console and log in with your Zoho Recruit username and password.

2. Choose Self Client from the list of client types, and click Create Now.

3. Click OK in the pop up to enable a self client for your account.

4. Now, your client ID and client secret are displayed under the Client Secret tab.

   

5. Click the Generate Code tab and enter the required scope separated by commas. The system throws an 'Enter a valid scope' error when you enter one or more incorrect scopes.

6. Select the Time Duration for which the grant token is valid. Please note that after this time, the grant token expires.

7. Enter a description and click Generate.

8. The generated code for the specified scope is displayed. Copy the grant token.