OAuth Authentication

Overview

OAuth is a delegated authorization framework that allows an application to access protected resources on behalf of a user without sharing the user's password.

Zoho Social uses OAuth so API clients can request limited, revocable access through access tokens. Permissions are controlled by scopes, and tokens can be rotated or revoked without changing account credentials.

For a detailed walkthrough of the Zoho OAuth workflow, see Zoho OAuth Protocol Documentation.

OAuth Scopes

Scopes define what actions an OAuth 2.0 token is allowed to perform. They are requested when generating the token and limit what the API will accept.

Scope	Access Granted
ZohoSocial.Organization.READ	Fetch portals, brands, and users
ZohoSocial.Integration.READ	Fetch channels and network connections
ZohoSocial.Publish.ALL	All publish operations
ZohoSocial.Media.ALL	Full media operations

Authorization Header

Every API request must include a valid OAuth 2.0 access token, passed as the Authorization HTTP header:

Authorization: Zoho-oauthtoken `access_token`

Unauthorized requests or expired tokens will return a 401 error.

Error for Invalid Token

{
    "error": {
        "code": 401,
        "requestURI": "/social/v2/users",
        "message": "INVALID_OAUTHTOKEN"
    }
}

Error For missing Scopes

{
    "error": {
        "code": 401,
        "requestURI": "/social/v2/users",
        "message": "INVALID_OAUTHSCOPE"
    }
}