Zoho CRM
Connect Zoho CRM to manage leads, contacts, accounts, deals and any custom module, plus notes, emails, tags, Blueprint and workflow settings.
You paste the Client ID and Client secret of a Server-based Application you register in the Zoho API Console, then sign in with Zoho and pick the CRM organization to connect.
- Setup time
- 6 min
- Auth
- OAuth authorization
- API base URL
- https://www.zohoapis.com/crm/v8
- Rate limits
- API credits per organization on a rolling 24-hour window: Free 5,000; Standard 50,000 plus 250 per user license (up to 100,000); Professional 50,000 plus 500 per license (up to 3,000,000); Enterprise 50,000 plus 1,000 per license (up to 5,000,000); Ultimate 50,000 plus 2,000 per license. Concurrent calls are capped at 5 to 25 by edition, and Zoho mints at most 10 access tokens per refresh token every 10 minutes.
Before you begin
- A Zoho CRM organization on any edition. Free includes 5,000 API credits a day.
- A Zoho CRM profile that is allowed to use the API. If the connect stops with a permission error, an administrator can turn it on under Setup, Security Control, Profiles.
- Knowing which Zoho data center your account lives in: the domain you sign in at, such as zoho.com, zoho.eu, zoho.in or zoho.com.au.
- PopMCP's callback URL from the connect form: https://app.popmcp.com/api/providers/zoho-crm/callback
Get your credentials
Open the API Console for your data center
Sign in at api-console.zoho.com as the Zoho user whose CRM access the AI should have. If your Zoho account lives in another data center, use that data center's console instead, for example api-console.zoho.eu, api-console.zoho.in or api-console.zoho.com.au. Click Get Started on your first visit, or Add Client if you already have clients.
Applications
Clients registered to call Zoho APIs with OAuth 2.0.
| Client name | Client type | Client ID |
|---|---|---|
| Reporting scriptCreated Mar 4, 2026 | Self Client | 1000.7Q2L****WK9T |
The console shows the clients of the data center you signed in to. A client made at api-console.zoho.eu does not appear at api-console.zoho.com.
Choose Server-based Applications
Pick Server-based Applications and click Create Now. PopMCP signs you in through a redirect, so the other client types, Self Client included, cannot complete the connection.
Choose a client type
The client type decides how users authorize your application.
| Client type | Use it for |
|---|---|
| Client-based Applications | Apps that run only in the browser |
| Server-based ApplicationsPick this one | Web apps with a server that redirect users to Zoho to authorize |
| Mobile-based Applications | Apps on phones and tablets |
| Non-browser Mobile Applications | Devices without a browser, such as smart TVs |
| Self Client | Back-end scripts with no redirect |
Server-based Applications is the only type that accepts PopMCP's redirect URL.
Name the client and add PopMCP's redirect URI
Enter a Client Name such as PopMCP and any Homepage URL, for example https://app.popmcp.com. Paste https://app.popmcp.com/api/providers/zoho-crm/callback into Authorized Redirect URI, then click Create.
Server-based Applications
Enter the client's details.
Zoho matches the redirect URI exactly, so paste it from the PopMCP connect form rather than typing it.
Copy the Client ID and Client Secret
Open the Client Secret tab and copy Client ID (it starts with 1000.) and Client Secret. You only need the Settings tab if people in other data centers will sign in through this client: there you can turn on Multi-DC and tick their data centers.
PopMCP
Server-based Applications
- Client ID
- 1000.X8RT****MQ2Z
- Client Secret
- 4c1f****b07e
The Client ID stays the same in every data center; with Multi-DC on, Zoho can give each data center its own secret.
Paste both values into PopMCP and sign in with Zoho
In PopMCP, paste the values into Client ID and Client secret. Only if you created the client outside zoho.com, open More options and type that data center into Zoho data center, for example EU, IN or AU. Click Sign in with Zoho, choose the CRM organization if Zoho asks, and accept the permissions.
Connect in PopMCP
Open your workspace, choose Zoho CRM in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Auth typepreset | Create it at api-console.zoho.com → Add Client → "Server-based Applications". The sign-in itself happens on Zoho. |
| Client IDtext | The "Client ID" on your app's Client Secret tab. |
| Client secretsecret | The "Client Secret" on the same tab. Stored encrypted and used only on the server.Encrypted with AES-256-GCM on save and never shown again. |
| Zoho data centertext | Only when your own app was made outside zoho.com: the data center its console is in, e.g. EU (zoho.eu), IN, AU, JP, CA, SA, UK or CN. One of: US, EU, IN, AU, JP, CA, SA, UK, AE, SG, CN. |
https://app.popmcp.com/api/providers/zoho-crm/callbackOnly for your own app: at api-console.zoho.com choose "Server-based Applications", set any homepage URL, and paste this exact URL as the Authorized Redirect URI.
PopMCP verifies the credential against Zoho CRM immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Zoho CRM at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| ZohoCRM.modules.READ | Reads records in every module, standard and custom: get_records, get_record, search_records, get_related_records, deleted records and record counts. Without it almost nothing works. |
| ZohoCRM.modules.emails.READ | Reads the emails linked to a record (list_record_emails, get_record_email) and their attachments. |
| ZohoCRM.settings.READ | Reads the org's setup: modules, fields, layouts, custom views, pipelines, Blueprints, workflow rules and territories. get_modules, get_fields and describe_module need it, and so do the automatic field lists on record reads. |
| ZohoCRM.users.READ | Lists users and reads one (list_users, get_user). PopMCP also reads the signed-in user at connect time to show it on the connection. |
| ZohoCRM.org.READ | Reads the organization's details. PopMCP calls it when you connect to name the connection and record its time zone, currency and data center, so the connect fails without it. |
| ZohoCRM.coql.READ | Runs COQL queries: run_coql_query and the structured query tool. |
| ZohoCRM.bulk.READ | Bulk read jobs: create_bulk_read_job, get_bulk_read_job and download_bulk_read_result for exports of up to 200,000 records. |
| ZohoCRM.bulk.backup.READ | Reads data backup schedules, history and download links. |
| ZohoCRM.notifications.READ | Lists the notification channels Zoho pushes record changes to. |
| ZohoCRM.files.READ | Downloads a file from Zoho CRM's file system by its id (download_file). |
| ZohoFiles.files.READ | Downloads an exported audit log from Zoho's file server. |
| ZohoCRM.templates.email.READ | Lists email templates (list_email_templates). |
| ZohoCRM.templates.inventory.READ | Reads inventory templates for quotes, sales orders, purchase orders and invoices. |
| ZohoCRM.mass_update.READ | Checks the status of a mass update job (get_mass_update_status). |
| ZohoCRM.mass_delete.READ | Checks the status of a mass delete job. |
| ZohoCRM.mass_convert.leads.READ | Checks the status of a mass lead conversion job. |
| ZohoCRM.change_owner.READ | Checks mass owner-change and user transfer jobs. |
| ZohoCRM.apis.READ | Lists the APIs available to the org (list_available_apis). |
| ZohoCRM.features.READ | Reads which features and limits the org's edition and user licenses include. |
| ZohoCRM.zia.enrichment.READ | Reads Zia data enrichment configurations and field mappings. |
| ZohoCRM.modules.ALL | Creates, updates, upserts and deletes records, and covers notes, attachments, tags, lead conversion, related-record links and Blueprint transitions. Without it every record write fails with OAUTH_SCOPE_MISMATCH. |
| ZohoCRM.settings.ALL | Changes the org's setup: fields, layouts, custom views, workflow rules, Blueprints, cadences, territories, webforms and kiosks. Only the setup tools beyond the default set use it. |
| ZohoCRM.users.ALL | Adds and updates users and assigns them to territories. |
| ZohoCRM.org.ALL | Changes organization-level details such as the org photo. |
| ZohoCRM.bulk.CREATE | Starts bulk write jobs that insert, update or upsert records from an uploaded file. |
| ZohoCRM.bulk.backup.ALL | Schedules and cancels data backups. |
| ZohoCRM.notifications.ALL | Turns on, updates and turns off notification channels. PopMCP's 25 Zoho CRM webhook triggers, such as Lead created and Deal updated, are registered this way. |
| ZohoCRM.send_mail.all.CREATE | Sends email from a record (send_email). Each send costs 20 API credits. |
| ZohoCRM.files.CREATE | Uploads files to Zoho CRM's file system (upload_files) so they can be attached to file and image fields. |
| ZohoFiles.files.ALL | Uploads the file a bulk write job reads, and downloads data backup files. |
| ZohoCRM.mass_update.UPDATE | Updates up to 500 records in one call (mass_update_records). |
| ZohoCRM.mass_delete.DELETE | Deletes records in bulk (mass_delete_records), which is kept out of the default tool set. |
| ZohoCRM.mass_convert.leads.CREATE | Converts many leads in one job (mass_convert_leads). |
| ZohoCRM.change_owner.CREATE | Changes record owners, one record or many (change_record_owner, mass_change_owner), and transfers a user's records. |
| ZohoCRM.composite_requests.CUSTOM | Sends several API calls as one composite request (run_composite_request). |
| ZohoCRM.zia.enrichment.CREATE | Creates Zia data enrichment configurations. |
| ZohoCRM.zia.enrichment.UPDATE | Updates Zia data enrichment configurations. |
| ZohoCRM.zia.enrichment.DELETE | Deletes a Zia data enrichment configuration. |
Verify it worked
PopMCP shows Zoho CRM as Connected under your organization's company name, and zoho_crm_get_organization returns that org with its time zone and currency while zoho_crm_get_modules lists your modules' API names.
Troubleshooting
"Zoho did not accept the Client ID and Client secret for the United States data center"
Why: The client was created in another data center's console, such as api-console.zoho.eu, while **Zoho data center** was left empty, or one of the values was mistyped.
Fix: Type that data center (EU, IN, AU, JP, CA, SA, UK, AE, SG or CN) into **Zoho data center** under **More options**, or turn on Multi-DC on the client's **Settings** tab. Recopy both values from the **Client Secret** tab.
"Zoho rejected the redirect URI"
Why: The client's **Authorized Redirect URI** does not exactly match PopMCP's callback.
Fix: Open the client in the API Console, correct **Authorized Redirect URI** on the **Client Details** tab to `https://app.popmcp.com/api/providers/zoho-crm/callback`, save, and connect again.
"The Zoho sign-in expired before it could be completed"
Why: Zoho's authorization codes last about two minutes, and the consent screen was left open too long.
Fix: Click **Sign in with Zoho** again and accept the consent screen without waiting.
"Your Zoho CRM profile is not allowed to use the API"
Why: Zoho answered NO_PERMISSION: the signed-in user's profile does not include API access.
Fix: Ask a Zoho CRM administrator to turn on Zoho CRM API Access for your profile under Setup, Security Control, Profiles, or connect as a user whose profile has it.
"Zoho signed you in but did not grant access to your Zoho CRM organization"
Why: Zoho answered OAUTH_SCOPE_MISMATCH: the permissions were not all accepted, or the Zoho account has no CRM organization.
Fix: Connect again and accept every permission on Zoho's consent screen. Make sure the Zoho user you sign in with belongs to a Zoho CRM organization.
A working connection stops with "Zoho no longer accepts this connection's authorization"
Why: The refresh token was revoked, the user's password changed, or more than 20 connections were made for the same Zoho user and client, which makes Zoho retire the oldest.
Fix: Disconnect and reconnect Zoho CRM. Avoid reconnecting the same user many times with one client.
LIMIT_EXCEEDED or TOO_MANY_REQUESTS
Why: The organization used up its rolling 24-hour API credits or hit its edition's concurrency limit. Record counts, bulk reads and email sends cost more credits than plain reads.
Fix: Wait and retry, split large jobs, and use a bulk read job instead of paging through thousands of records.