ZOHO CRM Not getting refresh token in response

Question

I am developing an application in iOS and android, in that i am integrating ZOHO CRM. I use OAuth2.0 for authentication, after that i use REST API to get "refresh token" but i am only get "access token". There are in bellow code to get token. How can i get refresh token?

self.getCodeFromCRM(client_id: Client_ID,
                            clientSecret: secID,
                            authURL: "https://accounts.zoho.in/oauth/v2/auth",
                            accessURL: "offline",
                            responseType: "code",
                            callBackURL: "zohoapp://",
                            scope: "ZohoCRM.modules.contacts.all",//ZohoCRM.users.ALL
                            state: "code")

After getting code calling this API to get refresh and access token.

func getZohoReferenceToken()
    {
        let headers = [
            "Content-Type": "application/x-www-form-urlencoded",
            "User-Agent": "PostmanRuntime/7.13.0",
            "Accept": "*/*",
            "Cache-Control": "no-cache",
            "Postman-Token": "88ebde59-240a-4e52-8ff9-bb7384eba0dd,9a1d5ea1-a5c0-490e-b3b5-1884e335ef86",
            "Host": "accounts.zoho.in",
            "accept-encoding": "gzip, deflate",
            "content-length": "254",
            "Connection": "keep-alive",
            "cache-control": "no-cache"
        ]

        let postData = NSMutableData(data: "client_id=\(Client_ID)".data(using: String.Encoding.utf8)!)
        postData.append("&client_secret=\(secID)".data(using: String.Encoding.utf8)!)
        postData.append("&redirect_uri=zohoapp://".data(using: String.Encoding.utf8)!)
        postData.append("&code=\(code)".data(using: String.Encoding.utf8)!)
        postData.append("&grant_type=authorization_code".data(using: String.Encoding.utf8)!)
        postData.append("&prompt=consent".data(using: String.Encoding.utf8)!)

        let request = NSMutableURLRequest(url: NSURL(string: "https://accounts.zoho.in/oauth/v2/token")! as URL,
                                          cachePolicy: .useProtocolCachePolicy,
                                          timeoutInterval: 10.0)
        request.httpMethod = "POST"
        request.allHTTPHeaderFields = headers
        request.httpBody = postData as Data

        let session = URLSession.shared
        let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
            if (error != nil) {
                print(error!)
            } else {
                let httpResponse = response as? HTTPURLResponse
                print(httpResponse!)

                do {
                    //create json object from data
                    if let json:NSDictionary = try JSONSerialization.jsonObject(with: data!, options: .mutableContainers) as? NSDictionary
                    {
                        // UserDefaults.standard.set(json.value(forKey: "access_token") as! String, forKey: "ZOHO_access")
                        print(json)
                        let access:String = ""//json.value(forKey: "access_token") as! String;
                        let ref:String = ""//json.value(forKey: "refresh_token") as! String

                        DispatchQueue.main.asyncAfter(deadline: .now() + 3.0, execute: {
                            self.displayAlert(appname: "ZOHO", accessToken: access, referenseToken: ref)
                        })
                    }
                } catch let error {
                    print(error.localizedDescription)
                }
            }
        })

        dataTask.resume()
}

Response: You can see in bellow response i am not getting refresh token. Please help me how can i get refresh token?

{
    "access_token": "1000.2......",
    "expires_in_sec": 3600,
    "api_domain": "https://www.zohoapis.in",
    "token_type": "Bearer",
    "expires_in": 3600000
}

Answer 1

I had the same problem but eventually found the answer in the documentation for the Mail API. To force a refresh token you need to add two additional arguments to the initial Post:

access_type=offline&prompt=consent

This ensures you get a refresh token as well as an access token.