Zoho Sign

Record your Zoho Sign connection as digital signature evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Zoho Sign:

   1. Sign in to the Zoho API Console at https://api-console.zoho.com/ and click Add Client ID to register a client; note the Client ID and Client Secret it gives you.
   2. Under the Generate Code tab, enter read-only scopes (for example ZohoSign.documents.READ,ZohoSign.templates.READ,ZohoSign.account.READ), set the time duration and click CREATE. Copy the generated code.
   3. Exchange the code for tokens with POST https://accounts.zoho.com/oauth/v2/token?code=<Code>&client_id=<Client ID>&client_secret=<Client Secret>&redirect_uri=<Redirect URL>&grant_type=authorization_code, and paste the access token into Safeguard's API token / Personal access token field.

   Where to find the other values:

   • Base URL (optional): Not shown in a documented UI location. Zoho's quick start uses https://accounts.zoho.com for tokens; data-center-specific domains are not listed on the fetched pages.
   • Account / Org / Workspace (optional): Not shown in a documented UI location.

   Zoho Sign's public documentation does not cover every step.

   Zoho Sign has no static API key; it uses OAuth 2.0. Access tokens usually expire in one hour, while the refresh token stays valid until revoked, so a pasted access token goes stale fast. Zoho's quick start example uses the broad ZohoSign.documents.ALL,ZohoSign.templates.ALL scopes; the READ scopes come from the OAuth scope list. The client type choice in the API Console (for example a self client) was not described on the fetched page.

   Source: zoho.com, zoho.com, checked 2026-10-07.

2. On Compliance › Connectors, open Zoho Sign, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Zoho Sign publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• Digital Signature connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks