Begin Login with Zoho
const url = 'https://api.sloose.com/auth/zoho/start?dc=au&rediscover=1';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.sloose.com/auth/zoho/start?dc=au&rediscover=1'Open this in a popup. It redirects to Zoho’s consent screen; when the user finishes, /auth/zoho/done posts { type: "sloose:session", token, … } back to window.opener and closes.
Only the configured widget origin may receive a session — return is checked against it, and localhost is additionally allowed in development. Anything else is refused, because the return origin is where a session token would be delivered.
The session is a Better Auth session token: send it as Authorization: Bearer. It lasts eight hours from its last use and can be ended with POST /auth/ba/sign-out.
Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”Zoho data centre: us, eu, in, au, cn or jp. Defaults to us.
Example
auZoho data centre: us, eu, in, au, cn or jp. Defaults to us.
Where to post the session. Must be the widget origin.
Where to post the session. Must be the widget origin.
Set to 1 to re-read the CRM’s modules and fields on the way back, even if a snapshot already exists. This is how “refresh from the CRM” works without an offline grant.
Example
1Set to 1 to re-read the CRM’s modules and fields on the way back, even if a snapshot already exists. This is how “refresh from the CRM” works without an offline grant.
Responses
Section titled “Responses”Redirect to Zoho’s consent screen.
dc is not a known Zoho data centre, or return is not the widget origin.
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}ZOHO_CLIENT_ID is not configured on this deployment.
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}The sign-in could not be started.
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}