KAVA · Internal Ops

Zoho Token Auth

Mint a Zoho OAuth refresh token for a customer app. Register the app in the Zoho API console first, set its Authorized Redirect URI to the value below, then authorise once — you consent in Zoho and the token is stored (or shown) here.

Redirect URI https://token-auth.kava-apps.com/callback

Access

Shared secret — gate

Zoho app

Label — shown on the confirmation page Client ID — from the Zoho app Client secret Data-centre domain

Scopes

Preset — the KAVA service this app is for Scope string — comma-separated, no spaces (auto-normalised)

Destination

Where the token goes SSM prefix — blank = /zoho_credentials (sync) · /BACKUP (export) · /FULL-BACKUP (backup) Client key — the <CLIENT_ID> folder, e.g. MYGEN Secrets Manager name — ssm_sm only; default zoho_auth_<CLIENT_KEY>

one consent per app · secrets never written to logs