How to Integrate Lovable with Zoho CRM

Zoho CRM uses OAuth2 for all API authentication. You must register your integration as a 'Server-Based Application' in the Zoho Developer Console before making any API calls. Go to api-console.zoho.com and sign in with your Zoho account. Click 'Add Client'. Choose 'Server-based Applications' — this is the correct type for Edge Function server-to-server calls. Fill in: - Client Name: 'Lovable CRM Integration' (or any descriptive name) - Homepage URL: your Lovable app URL - Authorized Redirect URIs: https://yourapp.lovable.app/oauth/callback (used for the one-time code exchange) After saving, Zoho displays a Client ID and Client Secret. Copy both. Now, generate the authorization code. Construct this URL and open it in your browser (replace YOUR_CLIENT_ID and YOUR_REDIRECT_URI): https://accounts.zoho.com/oauth/v2/auth?scope=ZohoCRM.modules.ALL,ZohoCRM.settings.ALL&client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=YOUR_REDIRECT_URI&access_type=offline For EU accounts, use accounts.zoho.eu; for India, accounts.zoho.in. The 'access_type=offline' parameter is required for a refresh token. After you authorize, Zoho redirects to your redirect URI with a 'code' parameter. Copy the code value — it expires in 10 minutes. Exchange the code for tokens: POST to https://accounts.zoho.com/oauth/v2/token with grant_type=authorization_code, client_id, client_secret, redirect_uri, and code. Use Postman or similar — send as form URL-encoded body. The response includes access_token, refresh_token, expires_in, and api_domain. Copy all four values.

Zoho CRM OAuth2 integration requires five secrets in Lovable's Cloud Secrets panel. In Lovable, click '+' → Cloud panel → Secrets tab. Add: - ZOHO_CRM_CLIENT_ID — your application Client ID from the Zoho Developer Console - ZOHO_CRM_CLIENT_SECRET — your application Client Secret - ZOHO_CRM_ACCESS_TOKEN — the current access token (valid for one hour from generation) - ZOHO_CRM_REFRESH_TOKEN — the long-lived refresh token (used to get new access tokens) - ZOHO_CRM_BASE_URL — the API base URL from the token exchange api_domain field (e.g., https://www.zohoapis.com) The accounts domain (used for token refresh) is derived from the base URL by replacing 'www.zohoapis' with 'accounts.zoho'. For example, if ZOHO_CRM_BASE_URL is https://www.zohoapis.eu, the token refresh URL is https://accounts.zoho.eu/oauth/v2/token. Zoho CRM access tokens expire after one hour. Your Edge Function implements automatic refresh: when a 401 is returned, use the client credentials and refresh token to obtain a new access token. The refresh token itself does not expire as long as it is used at least once every 60 days. For Zoho CRM specifically, the default module names used in API paths are: Leads, Contacts, Accounts, Deals (not Opportunities), Activities, Calls, Meetings. Custom modules use their API name (visible in Zoho CRM → Settings → Modules and Fields).

Build the Edge Function that handles Zoho CRM operations with automatic OAuth2 token refresh. The function uses the same pattern as the Zoho Books Edge Function: attempt the API call, and if a 401 is returned, refresh the token using the client credentials and retry. Zoho CRM API v2 endpoints follow the pattern: GET/POST/PUT/DELETE https://www.zohoapis.com/crm/v2/{module}. Records are wrapped in a 'data' array in both requests and responses. Create operations POST an array with one or more record objects; the response includes per-record success/error status in the 'data' array. For searching, Zoho CRM provides a dedicated search endpoint: GET /crm/v2/{module}/search?criteria=(fieldName:equals:value). Multiple criteria use 'and' or 'or' operators: (Email:equals:user@example.com) and (Company:equals:Acme). This is far more reliable than the full-text search endpoint for field-specific lookups. For fetching records, use GET /crm/v2/{module} for all records (paginated by default at 200 per page), or GET /crm/v2/{module}/{recordId} for a specific record. The response includes 'info' with pagination data. Zoho CRM API v2 has a rate limit of 5,000 API calls per day for free accounts and 25,000 for paid plans. For production integrations with high-volume syncing, implement request batching using Zoho's bulk CRUD endpoints.

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8async function refreshToken(): Promise<string> {
9  const baseUrl = Deno.env.get('ZOHO_CRM_BASE_URL')!
10  const accountsDomain = baseUrl.replace('www.zohoapis', 'accounts.zoho')
11  const resp = await fetch(`${accountsDomain}/oauth/v2/token`, {
12    method: 'POST',
13    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
14    body: new URLSearchParams({
15      grant_type: 'refresh_token',
16      client_id: Deno.env.get('ZOHO_CRM_CLIENT_ID')!,
17      client_secret: Deno.env.get('ZOHO_CRM_CLIENT_SECRET')!,
18      refresh_token: Deno.env.get('ZOHO_CRM_REFRESH_TOKEN')!,
19    }),
20  })
21  const data = await resp.json()
22  if (!data.access_token) throw new Error('Token refresh failed')
23  return data.access_token
24}
25
26async function crmFetch(path: string, method = 'GET', body?: unknown, retry = true): Promise<unknown> {
27  const base = Deno.env.get('ZOHO_CRM_BASE_URL')!
28  let token = Deno.env.get('ZOHO_CRM_ACCESS_TOKEN')!
29
30  let resp = await fetch(`${base}/crm/v2${path}`, {
31    method,
32    headers: {
33      Authorization: `Zoho-oauthtoken ${token}`,
34      'Content-Type': 'application/json',
35    },
36    body: body ? JSON.stringify(body) : undefined,
37  })
38
39  if (resp.status === 401 && retry) {
40    token = await refreshToken()
41    resp = await fetch(`${base}/crm/v2${path}`, {
42      method,
43      headers: {
44        Authorization: `Zoho-oauthtoken ${token}`,
45        'Content-Type': 'application/json',
46      },
47      body: body ? JSON.stringify(body) : undefined,
48    })
49  }
50  return resp.json()
51}
52
53serve(async (req) => {
54  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
55
56  try {
57    const { action, module: mod = 'Leads', params = {} } = await req.json()
58    let result
59
60    switch (action) {
61      case 'create_record':
62        result = await crmFetch(`/${mod}`, 'POST', { data: [params] })
63        break
64      case 'search_records':
65        result = await crmFetch(`/${mod}/search?criteria=${encodeURIComponent(params.criteria)}&per_page=${params.perPage || 20}`)
66        break
67      case 'get_record':
68        result = await crmFetch(`/${mod}/${params.recordId}`)
69        break
70      case 'update_record':
71        result = await crmFetch(`/${mod}/${params.recordId}`, 'PUT', { data: [params.fields] })
72        break
73      default:
74        return new Response(JSON.stringify({ error: 'Unknown action' }), {
75          status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
76        })
77    }
78
79    return new Response(JSON.stringify(result), {
80      headers: { ...corsHeaders, 'Content-Type': 'application/json' },
81    })
82  } catch (error) {
83    return new Response(JSON.stringify({ error: error.message }), {
84      status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
85    })
86  }
87})

With the Edge Function deployed, wire it into your Lovable app's key user flows. Call supabase.functions.invoke('zoho-crm') with the appropriate action, module, and params wherever CRM data needs to flow. For lead creation from signup flows: invoke after Supabase Auth creates the user account, passing name, email, company, and a Lead_Source value matching your Zoho CRM picklist. Use the fire-and-forget pattern (no await) so CRM creation does not slow down the registration success response. For CRM dashboards visible to your team, fetch Deals or Contacts with the search_records action using criteria to filter by relevant fields. Zoho CRM search criteria use the format: (Field_Name:operator:value). Operators are 'equals', 'not_equal', 'contains', 'starts_with', 'greater_equal', 'lesser_equal'. Combine with 'and' or 'or': ((Stage:equals:Qualification)and(Amount:greater_equal:10000)). For account-level operations that involve multiple modules (creating an Account, Contact, and Deal together), make the API calls sequentially in the Edge Function: create Account → create Contact with Account_Name → create Deal with Account_Name and Contact_Name. Zoho CRM links records by name fields in most cases, though record IDs are more reliable for associations. For complex multi-module integration workflows such as triggering Zoho CRM workflow rules via API-initiated record changes or using Zoho's Blueprint (process management) API, RapidDev's team can help design the correct Edge Function architecture.