---
title: "Generate Access and Refresh Token"
url: https://docs.catalyst.zoho.com/en/api/oauth2/generate-access-and-refresh-token/
description: "Learn about the OAuth 2.0 industry-standard protocol adhered by Catalyst that authenticates and authorizes API requests made by users to gain secure access to protected Catalyst resources."
last_updated: 2025-11-19T15:07:41Z
service: All Services
type: api
---

<!-- Leftcontent -->

# Step 3: Generate Access Token and Refresh Token

### Request Execution

After you obtain the Grant Token, send a `POST` request to the following URL with the params given
below to generate the `access\_token`:

`https://<span></span>accounts.zoho.com/oauth/v2/token?`

> **Note:** You must access the respective domains for the other [data centers](https://docs.catalyst.zoho.com/en/api/introduction/multi-dc-support/#Multi-DCSupport): 
* **EU:** `https://<span></span>accounts.zoho.eu/`
* **AU:** `https://<span></span>accounts.zoho.au/`
* **IN:** `https://<span></span>accounts.zoho.in/` 
* **CA:** `https://<span></span>accounts.zohocloud.ca/`
* **JP:** `https://<span></span>accounts.zohocloud.jp/`
* **SA:** `https://<span></span>accounts.zohocloud.sa/` 

<table class="content-table">
  <thead>
    <tr>
      <th class="w30p">Parameter</th>
      <th class="w70p">Description</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>`code`*</td>
      <td>
        The Grant Token or the value of code obtained in the previous step.
      </td>
    </tr>
    <tr>
      <td>`client_id`*</td>
      <td>The Client ID that was generated during the client registration</td>
    </tr>
    <tr>
      <td>`client_secret`*</td>
      <td>
        The Client Secret that was generated during the client registration
      </td>
    </tr>
    <tr>
      <td>`grant_type`*</td>
      <td>
        `authorization_code` (Provide this literal string
        as the value)
      </td>
    </tr>
    <tr>
      <td>`redirect_uri`</td>
      <td>
        One of the Authorized Redirect URIs you provided while registering the
        client in the previous step. You must not provide an unregistered
        redirect URI.
      </td>
    </tr>
    <tr>
      <td>`scope`</td>
      <td>
        The scope the `access_token` is to be generated
        for. You can provide multiple scopes by separating them using commas.
You
        can check the list of scopes available in Catalyst from [this
        section](https://docs.catalyst.zoho.com/en/api/oauth2/scopes/).
      </td>
    </tr>
    <tr>
      <td>`state`</td>
      <td>
        An opaque string that is round-tripped in the protocol. In other words,
        whatever value you provide here will be passed back to you.
      </td>
    </tr>
  </tbody>
</table>

> **Note:**
* Fields marked with * are mandatory.
* You can pass the parameters in the body of your request as `form-data`, for increased security.

* The `access\_token` will expire after the time period (in seconds) mentioned in the
`expires\_in` parameter.
* However, the `refresh\_token` is permanent and can be used to regenerate a new
`access\_token` if the current one expires.
* You can use the domain specified in `api\_domain` in your requests to make API calls to Catalyst.
* The "Bearer" value in the `token\_type` indicates this is an
`access\_token`.

This completes the authentication process. Once you obtain the `access\_token` for your
application, you can use it in the authorization header of your HTTP requests to access Catalyst APIs. You can refer to the [Request Format](https://docs.catalyst.zoho.com/en/api/oauth2/generate-access-and-refresh-token/#RequestFormat) section for an example.

> **Note:** Each time a re-consent page is accepted, a new `refresh\_token` is generated. You can generate a maximum of 20 refresh tokens per user, and 5 refresh tokens in a minute. If this limit is crossed, the first `refresh\_token` is automatically deleted to accommodate the latest one. This is done irrespective of whether the first one is in use or not.

**Sample Request**

```bash
https://accounts.zoho.com/oauth/v2/token?code=1000.dd7xxxxxxxxxxxxxxxxxxxxxxxxx.b6c07xxxxxxxxxxxxxxxxxxxx&client_id=1000.0SRSxxxxxxxxxxxxxxxxx&client_secret=xxxxxxxxxxxxxxxxxxxxx&redirect_uri=http://www.zoho.com/catalyst&grant_type=authorization_code
```

**Sample Response**

```json

    {
        "access_token": "{access_token}",
        "refresh_token": "{refresh_token}",
        "api_domain": "https://www.zohoapis.com",
        "token_type": "Bearer",
        "expires_in": 3600
    }
```