Authorization Code Flow (PKCE)

Use this flow when your application makes ZoomInfo API requests on behalf of an authenticated user.

After the user signs in and grants permission, your application receives an access token that represents that user. Every API request made with this token returns data specific to the authenticated user.

For example, Contact Recommendations are personalized based on the authenticated user's activity in ZoomInfo, such as profile views, CRM exports, and other engagement signals. Using this flow ensures your application returns the same personalized recommendations and user-specific experience available in ZoomInfo.

ZoomInfo requires PKCE (Proof Key for Code Exchange) on top of the standard authorization code grant. This prevents authorization code interception attacks.

Before You Begin

Before implementing the authorization flow, ensure that you have:

• Created an application and obtained its Client ID.
• Configured a valid redirect URI.
• Implemented secure storage for access tokens and refresh tokens.

Integration Steps

The authorization process consists of four steps:

Generate a PKCE code verifier and code challenge.
Redirect the user to ZoomInfo for authentication and consent.
Receive an authorization code through your redirect URI.
Exchange the authorization code for an access token and refresh token.

Looking to implement this flow in Python, Java, or JavaScript? We've provided complete implementation recipes for each language.

1. Generate a PKCE Challenge

Generate a random code_verifier and derive a code_challenge using SHA-256 encoding. The code_challengeis sent during authorization, while the original code_verifier is used later when exchanging the authorization code for tokens.

Store the code_verifier securely, as it is required in Step 4 when exchanging the authorization code for an access token.

2. Request User Authorization

Redirect the user to the authorization endpoint.

GET https://api.zoominfo.com/auth/authorize

https://api.zoominfo.com/auth/authorize?
response_type=code&
client_id=YOUR_CLIENT_ID&
redirect_uri=https://your-app.com/callback&
code_challenge=CODE_CHALLENGE&
code_challenge_method=S256&
state=RANDOM_STATE

The following query parameters are required for every authorization code request.

Additionally, these optional parameters may be provided in the authorization code request

If you don't specify any scopes, the authorization request will use all the scopes selected for your application in the ZoomInfo app creation portal. See the full list of available scopes.

After the user successfully authenticates and grants access, ZoomInfo redirects them to the configured redirect URI.

3. Receive the Authorization Code

The redirect URI receives a temporary authorization code.

https://your-app.com/callback?code=AUTHORIZATION_CODE

Extract and store the authorization code. Authorization codes are short-lived and can only be exchanged once.

4. Exchange the Code for Token

Exchange the authorization code for an access token by sending a request to the token endpoint.

The request must include your application's client_id and client_secret so ZoomInfo can authenticate your application. You can provide these credentials in one of two ways:

• HTTP Basic Authentication (recommended)
• Request body parameters

HTTP Basic Authentication is the preferred method because it keeps client credentials separate from the request payload.

If both methods are used, the Authorization header takes precedence, and any credentials included in the request body are ignored.

Request Parameters

Upon successful verification of the external client's credentials and authorization details, ZoomInfo's authorization server will respond with the access token. The response will always be encoded in the application/json content type.

{
  "access_token": "eyJraWQiOiJKdThxUW1tTUx1SG9QSEFVQlJnUmh...jnIn951t3kLf6VZ6SOsYKSVY9kGeNbCGkufCNLQ",
  "expires_in": 1000,
  "id_token": "eyJraWQiOiJKdThxUW1tTUx1SG9QSEFVQlJnUmh...CUxqHWQpbUXU0TTuzrQilNWEoggi5haJkQ",
  "refresh_token": "7PV7YVxG0UswgzFFaX-mDMoVRIgN5WEfLS0hfx9qSDo",
  "scope": "api:data:company api:data:contact api:audience:read...",
  "token_type": "Bearer"
}

Use the Access Token

Include the access token in the Authorization header when calling ZoomInfo APIs.

Authorization: Bearer ACCESS_TOKEN

Refresh Expired Access Token

When the access token expires, use the refresh token to obtain a new access token without requiring the user to re-authorize the application.

See the Refresh Token documentation for implementation details.

Error Handling

Security Best Practices

• Always use S256 for PKCE.
• Validate the state parameter after redirect.
• Use HTTPS for all authorization and token requests.
• Store access and refresh tokens securely.
• Never expose tokens in client-side logs or URLs.