.gif)
We build custom applications 5x faster and cheaper 🚀
Book a Free Consultation
Stuck on an error? Book a 30-minute call with an engineer and get a direct fix + next steps. No pressure, no commitment.
Short answer: Build the Zoho Bigin integration around explicit OAuth2 authentication and standard REST calls. Perform the interactive OAuth authorization on an external web service (not inside the agent), exchange the code there for a long‑lived refresh token, store that refresh token securely (a secret store or ClawHub secret), and configure an OpenClaw skill to refresh access tokens at runtime and call the Zoho Bigin REST API. Handle webhooks (if you need near‑real‑time events) with an external HTTPS endpoint that validates Zoho’s webhook signature and then forwards events into your system (queue or agent invocation). Keep stateful, long‑running, or scheduled responsibilities outside the agent runtime; keep the skill code stateless and focused on authenticated API calls.
.png)
.png)
# <b>//</b> POST to Zoho token endpoint to exchange authorization code for tokens
curl -X POST "https://accounts.zoho.com/oauth/v2/token" \
-d "grant_type=authorization_code" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "redirect_uri=https://your-auth-host.example.com/callback" \
-d "code=THE_AUTHORIZATION_CODE"
# <b>//</b> Use refresh_token to obtain an access_token
curl -X POST "https://accounts.zoho.com/oauth/v2/token" \
-d "grant_type=refresh_token" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "refresh_token=YOUR_REFRESH_TOKEN"
# <b>//</b> Example GET - replace API base with your Zoho region endpoint if required
curl -X GET "https://www.zohoapis.com/bigin/v1/contacts" \
-H "Authorization: Bearer ACCESS_TOKEN"
// <b>//</b> Minimal example using fetch (Node 18+ or polyfill)
import fetch from 'node-fetch';
async function getZohoContacts({ clientId, clientSecret, refreshToken }) {
// <b>//</b> Refresh access token
const tokenResp = await fetch('https://accounts.zoho.com/oauth/v2/token', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
grant_type: 'refresh_token',
client_id: clientId,
client_secret: clientSecret,
refresh_token: refreshToken
})
});
if (!tokenResp.ok) {
const text = await tokenResp.text();
throw new Error(`Token refresh failed: ${tokenResp.status} ${text}`);
}
const tokenJson = await tokenResp.json();
const accessToken = tokenJson.access_token;
// <b>//</b> Call Bigin API with access token
const apiResp = await fetch('https://www.zohoapis.com/bigin/v1/contacts', {
headers: { Authorization: `Bearer ${accessToken}` }
});
if (!apiResp.ok) {
const text = await apiResp.text();
throw new Error(`API call failed: ${apiResp.status} ${text}`);
}
return apiResp.json();
}
Speak one‑on‑one with a senior engineer about your no‑code app, migration goals, and budget. In just half an hour you’ll leave with clear, actionable next steps—no strings attached.
1
A 401 during OAuth token refresh means the authorization server rejected the refresh request (expired/revoked refresh token, wrong client credentials, or malformed request). Fix by inspecting the token endpoint response and logs, re-running the consent/refresh flow to obtain a new refresh token, and ensuring the skill uses correct client credentials and securely stored refresh tokens.
// realistic refresh call
async function refreshToken(url, clientId, clientSecret, refreshToken) {
const res = await fetch(url, {
method: 'POST',
headers: {'Content-Type':'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'refresh_token', client_id: clientId, client_secret: clientSecret, refresh_token: refreshToken
})
});
if (res.status === 401) throw new Error('Refresh rejected: check credentials/refresh token');
return res.json();
}
2
The most common cause is using the field label instead of the field’s API name, sending the wrong JSON shape, or lacking permission/auth for custom fields. Verify the custom field’s API name in Zoho Bigin, ensure your skill sends that exact key in the record payload, and confirm the OAuth token or API key has field-write scope.
// send exact API field names
{"contact_name":"Acme","custom_field_api_name":"value"}
3
Direct answer: If outbound webhooks time out or are rate‑limited, acknowledge quickly, stop doing long work inline, and implement retry/backoff, idempotency, batching, and queueing so the OpenClaw agent runtime never blocks on slow external endpoints.
// fast ack + enqueue pattern (Node/Express)
app.post('/webhook', (req,res)=>{
res.sendStatus(202); // quick response
queue.push({id:req.body.id, payload:req.body}); // // enqueue to external worker
});
4
Yes — duplicates happen when the external system record key (external_id) is missing or wrong or when your skill issues a create instead of an idempotent upsert. Fix by ensuring every created contact/deal carries a stable external_id, perform a lookup-by-external_id before create (or call the provider's upsert), and backfill/merge existing duplicates once.
Do these steps:
// check by external_id then create/update
const res = await fetch(`${API}/contacts?external_id=${eid}`, {headers:{Authorization:`Bearer ${KEY}`}});
// // if found PATCH, else POST
This prompt helps an AI assistant understand your setup and guide you through the fix step by step, without assuming technical knowledge.
From startups to enterprises and everything in between, see for yourself our incredible impact.
They do complex work on extremely fast timelines and effectively manage the testing and pre-launch process to deliver the best possible product. I'm extremely impressed with their execution ability.
