---
title: "Generate Grant Token"
url: https://docs.catalyst.zoho.com/en/api/oauth2/generate-grant-token/
description: "Learn about the OAuth 2.0 industry-standard protocol adhered by Catalyst that authenticates and authorizes API requests made by users to gain secure access to protected Catalyst resources."
last_updated: 2026-08-17T12:16:04Z
service: All Services
type: api
---

# Step 2: Generate Grant Token

After you generate the `client\_id` and `client\_secret`, you must generate a Grant Token or `code` for your application.

> **Note:** Generating a Grant Token is a one-time process, provided you generate the `access\_token` and `refresh\_token` within the time the Grant Token is valid for. 

### For Self Client Applications

If you previously selected the _Self Client_ type, you must generate the Grant Token (`code`) in
the following way:

1. After registering your application, select **Self Client** from the _Applications_ list in the
[API console](https://api-console.zoho.com/) and click **Generate Code**.
 ![](https://catalyst-docs-development.zohostratus.in/images/api/catalyst_api_5.webp)
2. Enter a valid scope. You can check the list of scopes available in Catalyst from [this section](https://docs.catalyst.zoho.com/en/api/oauth2/scopes/#Scopes).
3. Choose a time duration from the dropdown list. The Grant Token generated in this step will expire after this time period.

> **Note:** If the Grant Token is about to expire, you must generate a `refresh\_token` before it expires, as described in the next step.

4. Enter a description for the scope.
5. Click **Generate**.

The API console will display the generated Grant Token or `code` value for your _Self Client_ application.

![](https://catalyst-docs-development.zohostratus.in/images/api/catalyst_api_6.webp)

### For Other Applications

If you previously selected client types other than the _Self Client_ type, you must generate the Grant Token using a redirect method:

1. Send a request to the following URI with the params given below, to generate the Grant Token (`code`):

`https://<span></span>accounts.zoho.com/oauth/v2/auth?`

> **Note:** You must access the respective domains for the other [data centers](https://docs.catalyst.zoho.com/en/api/introduction/multi-dc-support/#Multi-DCSupport): 
* **EU:** `https://<span></span>accounts.zoho.eu/`
* **AU:** `https://<span></span>accounts.zoho.au/`
* **IN:** `https://<span></span>accounts.zoho.in/` 
* **CA:** `https://<span></span>accounts.zohocloud.ca/` 
* **JP:** `https://<span></span>accounts.zohocloud.jp/` 
* **SA:** `https://<span></span>accounts.zohocloud.sa/` 

<table class="content-table">
  <thead>
    <tr>
      <th class="w20p">Parameter</th>
      <th class="w80p">Description</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>
        `**scope\***`
      </td>
      <td>
        The scope the Grant Token is to be generated for. You can provide multiple scopes by separating them using commas. You can check the list of scopes available in Catalyst from [this section](https://docs.catalyst.zoho.com/en/api/oauth2/scopes/#Scopes).
      </td>
    </tr>
    <tr>
      <td>`**client\_id\*** `</td>
      <td>The Client ID that was generated during the client registration</td>
    </tr>
    <tr>
      <td>`**state** `</td>
      <td>An opaque string that is round-tripped in the protocol, i.e., whatever value you provide here will be passed back to you</td>
    </tr>
    <tr>
      <td>`**response\_type\***`</td>
      <td>`code `(Provide this literal string as the value) </td>
    </tr>
    <tr>
      <td>`**redirect\_uri\*** `</td>
      <td>One of the Authorized Redirect URIs you provided while registering the client in the previous step. You must not provide an unregistered redirect URI.</td>
    </tr>
    <tr>
      <td>`**access\_type** `</td>
      <td>The allowed values are `offline` and `online`. The online `access\_type` only provides the `Access Token` for your application, which is valid for one hour. The `offline access\_type` provides an `Access Token` as well as a `Refresh Token` for your application. The default value is considered to be `online`.</td>
    </tr>
    <tr>
      <td>`**prompt** `</td>
      <td>`Consent` (Provide this literal string as the value) Prompts for user consent every time your app tries to access user credentials. If you don't specify this parameter, the user will only be prompted for credentials the first time your app requests access.</td>
    </tr>
  </tbody>
</table>

> **Note:**

   * Fields marked with * are mandatory.

   * You can pass the parameters in the body of your request as `form-data`, for increased security.

**Request Example**

```bash
https://accounts.zoho.com/oauth/v2/auth?scope=ZohoCatalyst.tables.rows.CREATE,ZohoCatalyst.tables.rows.READ,ZohoCatalyst.tables.rows.UPDATE,ZohoCatalyst.tables.rows.DELETE&client_id=1000.0SRSxxxxxxxxxxxxxxxxx&state=testing&response_type=code&redirect_uri=https://www.zylker.com/ShipmentTracking/&access_type=offline
```

2. If you send the `prompt` parameter in this request, a user consent page will open.
 After you click **Accept**, Zoho will redirect you to the `redirect\_uri` with the Grant Token in the `code` parameter. Save the `code` value for the next steps.
 ![](https://catalyst-docs-development.zohostratus.in/images/api/catalyst_api_7.webp)
 Based on your login details, the system automatically detects your domain and uses the domain-specific authentication URL to generate the Grant Token. The `state` parameter is also passed in the URL.
 If you click **Reject**, the browser redirects to the redirect URI with the parameter `error=access\_denied`.

> **Note:** This code is only valid for 60 seconds. You must complete the next step within this time.