A Zoho Self Client is an OAuth client that has no redirect URL and no end user. Instead of sending someone through a consent screen, your workflows authenticate to Zoho Desk with the client's own ID and secret, and Sim mints a short-lived access token on demand — no user consent to expire, and no personal login that breaks when someone leaves the team.
This is the recommended way to use Zoho Desk in production workflows: the credential belongs to your organization rather than a person, the granted scopes are explicit, and tokens are minted fresh whenever a workflow runs.
Prerequisites
You need a Zoho account with access to the Zoho API Console for your data center, for the same organization your Zoho Desk portal belongs to, and the Zoho Desk organization ID for that portal. See Know Your Data Center for the console that matches your region.
A Self Client can authenticate against the US, EU, IN, or AU accounts server — pick your region from the Data center dropdown when you add the credential, or leave it unset for US. Organizations in the JP, CA, SA, CN, or UK data centers are not supported yet. API calls are then routed to the Desk host for that same region, so data residency is honored end to end.
The interactive OAuth connection is a separate path and remains US-only (accounts.zoho.com), so a non-US organization can connect only through a Self Client.
Zoho Desk webhooks are a Professional-edition and above feature. The Zoho Desk trigger in Sim provisions a webhook subscription, so it does not work on Free or Standard plans. The trigger also requires a personal OAuth connection rather than a Self Client — see Triggers below.
Setting Up the Self Client
1. Create the Self Client
Sign in to the Zoho API Console for your data center with the Zoho account that owns the Desk portal — see Know Your Data Center for the right one. A Self Client is registered in one data center and cannot authenticate against another region's accounts server
Click Add Client, choose Self Client, and click Create — then OK on the confirmation
Open the new client and switch to the Client Secret tab. Copy the Client ID and Client Secret — these are two of the three values you'll paste into Sim
You do not need the Generate Code tab. That tab produces a one-time authorization code for the code-exchange flow; the client-credentials flow Sim uses needs only the client ID, the client secret, and your organization ID.
2. Find Your Organization ID
Open Zoho Desk and go to Setup (the gear icon) → Developer Space → API
Copy the numeric Organization ID (also called the Org ID or portal ID) shown there — for example 600123456
This must be the organization ID of the Desk portal you want the workflows to act on. If your Zoho account has more than one Desk portal, using the wrong ID makes Zoho either reject the token request or issue a token scoped to the wrong portal.
3. Know Your Data Center
Zoho hosts each organization in one data center, and the accounts server that issues tokens is per region. Look at the URL you use to sign in to Zoho Desk and pick the matching region in the Data center dropdown:
| Sign-in domain | Data center to pick | API Console to create the Self Client in |
|---|---|---|
zoho.com | United States (the default when left unset) | api-console.zoho.com |
zoho.eu | Europe | api-console.zoho.eu |
zoho.in | India | api-console.zoho.in |
zoho.com.au | Australia | api-console.zoho.com.au |
Organizations in the JP, CA, SA, CN, and UK data centers cannot be connected yet.
Create the Self Client in the console for your data center. Zoho ties a client to the region it was registered in — "the accounts-server-url is specific to the location (i.e., datacenter) where the client is registered" — and the multi-data-center setting that would extend a client to other regions is not available for Self Clients. A Self Client created in the wrong console cannot be repointed later; create a new one in the right region.
4. Scopes
Sim requests the Zoho Desk scopes its tools and its webhook trigger exercise — the same list on both connection types:
Desk.tickets.READ
Desk.tickets.UPDATE
Desk.contacts.READ
Desk.agents.READ
Desk.basic.READ
Desk.webhooks.CREATE
Desk.webhooks.DELETESim sends this list on every token request, so there is nothing to pre-configure on the Self Client itself. The aaaserver.profile.READ scope Sim requests on the interactive OAuth flow is deliberately left off this grant — it is an Accounts profile scope, and this grant never calls the Accounts profile endpoint; identity is synthesized from the organization ID. If Zoho rejects the request with an invalid-scope error, the Self Client's owner does not have access to one of the Desk modules above in that organization.
Desk.webhooks.CREATE and Desk.webhooks.DELETE belong to the trigger, which runs on an OAuth connection only (see Triggers below). They are harmless on a Self Client grant, but a Free or Standard Desk plan may reject them, since webhooks are a Professional-edition feature.
A scope that is granted but insufficient surfaces at run time as a 4xx from the Zoho Desk API naming the scope problem.
5. Protect the Client Secret
The client secret is bearer material for your Zoho Desk organization, limited only by the scopes above. Treat it like a password — do not commit it to source control or share it publicly. Sim encrypts it at rest.
Regenerating or revoking the Self Client in the Zoho API Console invalidates the stored pair immediately. If you rotate it, update the credential in Sim right away.
Adding the Self Client to Sim
Open Integrations from your workspace sidebar
Search for "Zoho Desk" and open it, then click Add to Sim and choose Add Self Client
In the Add Zoho Desk Self Client dialog, paste the Client ID, the Client secret, and the numeric Organization ID. Pick your region from the Data center dropdown — leaving it unset uses the United States. Optionally set a display name and description
Click Add Self Client. Sim verifies the credentials by minting a real access token from Zoho — if it fails, the error tells you whether Zoho rejected the credentials or couldn't be reached.
Using the Self Client in Workflows
Add a Zoho Desk block to your workflow. In the credential dropdown, your Self Client appears alongside any OAuth credentials. Select it and configure the block as you normally would.
The block calls the Zoho Desk REST API with a freshly minted access token — the same requests as the OAuth flow, so the Zoho Desk tools work the same way, subject to the scopes above.
One exception is worth knowing: Zoho publishes no OAuth scope for the attachment download sub-path, so Get Attachment is the one operation whose scope requirement we could not confirm from Zoho's documentation. If it returns a scope error, the requested scope list needs widening.
Triggers still need OAuth
The Zoho Desk trigger provisions and tears down its own webhook subscription against your Desk organization, and that provisioning path currently runs only against a personal OAuth connection. Connect a Zoho Desk account through OAuth for triggers, and use the Self Client for the blocks that read and update tickets.
Because the OAuth flow is US-only, an organization outside the US data center can use Zoho Desk blocks through a Self Client but cannot use the Zoho Desk trigger.
Token Behavior
Access tokens minted from a Self Client live for one hour and there is no refresh token — Sim mints a new token whenever one is needed, and caches the current one until it is close to expiry. Two events invalidate the stored credential:
- Revoking or deleting the Self Client in the Zoho API Console — no new tokens can be minted
- Regenerating the client secret — the stored pair stops working; paste the new secret into the credential in Sim