Zoho CRM

Connect Zoho CRM to collect crm evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Zoho CRM:

   1. Open the Zoho Developer Console (api-console.zoho.com for your data center) and click GET STARTED.
   2. Choose Self Client, click CREATE NOW, then click CREATE (no client name, homepage URL or redirect URI is needed) and click OK in the pop-up.
   3. On the Client Secret tab, copy the Client ID and Client Secret.
   4. On the Generate Code tab, enter the read scope for CRM users, select the Time Duration, enter a description and click CREATE. Choose your portal, select the organization and environment, and click CREATE again. Copy the grant token shown.
   5. Exchange it with a POST to {accounts_URL}/oauth/v2/token using grant_type=authorization_code, client_id, client_secret and code.
   6. Paste the returned access_token into Safeguard's Access token field.

   Where to find the other values:

   • API URL: The api_domain value returned with the access token (for example https://www.zohoapis.com in the US data center).

   Zoho CRM's public documentation does not cover every step.

   Access tokens are valid for one hour only; the refresh_token never expires and is the durable credential, so a pasted access token goes stale quickly. Accounts URLs by data center: US accounts.zoho.com, AU accounts.zoho.com.au, EU accounts.zoho.eu, IN accounts.zoho.in, CN accounts.zoho.com.cn, JP accounts.zoho.jp, SA accounts.zoho.sa, CA accounts.zohocloud.ca. The grant token is valid only for the Time Duration chosen. The fetched pages show only ZohoCRM.users.ALL as an example scope; the read-only users scope name (ZohoCRM.users.READ in the earlier draft) was not confirmed.

   Source: zoho.com, zoho.com, zoho.com, checked 2026-10-07.

   The permissions Safeguard needs: ZohoCRM.users.READ.

2. On Compliance › Connectors, open Zoho CRM, click Connect, choose API token and fill in:

   Field	What to enter
   Access token	Required. Stored encrypted and never shown again.
   API URL	Required. For example: https://www.zohoapis.com

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Zoho CRM and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• CRM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks