Zoho Desk

Works with: Zoho Desk (cloud, any data centre). What SafeHanded does in Zoho Desk: private comments on every step · a public comment for link delivery · the chain-of-custody certificate attached on purge · close-to-purge · request from a ticket (deep link).

Before you start

A Zoho Desk admin, and a SafeHanded Owner/Admin on the Team plan or above.
About fifteen minutes (mostly the Zoho self-client).

1. Connect

Zoho uses OAuth 2.0. SafeHanded stores a long-lived refresh token and mints access tokens itself, so you generate the refresh token once via a Self Client. Do every step on your Zoho region (US zoho.com, EU zoho.eu, UK zoho.uk, India zoho.in, Australia zoho.com.au, Japan zoho.jp, Canada zohocloud.ca, …) — mixing regions is the usual failure.

orgId: in Zoho Desk, Setup → Developer Space → API and copy the orgId.
Self Client: at https://api-console.zoho.<dc>/, Add Client → Self Client → Create; copy the Client ID and Client Secret.
Authorization code (Generate Code tab): Scope Desk.tickets.ALL,Desk.contacts.READ,Desk.basic.READ,Desk.search.READ,aaaserver.profile.read (the aaaserver.profile.read scope is required for a self client), Time duration 10 minutes, then Create and copy the code.
In SafeHanded: Settings → Integrations → Connect → Zoho Desk. Enter the orgId as the Organization id, the Client id, Client secret, the Authorization code, and your Data centre, then click Connect and test. SafeHanded exchanges the code for a refresh token itself and stores only the token. The code is single-use and expires in minutes — if it’s lapsed, generate a fresh one. (Zoho Desk API)

2. Close detection

Nothing to set up. SafeHanded polls Zoho Desk for status changes, so resolving or closing a ticket purges its credential on the next poll. SafeHanded re-reads the ticket via the API before anything is purged — see how ticketing works.

3. Request from a ticket (deep link)

Zoho Desk has built-in Custom Buttons, which put a button on every ticket.

In Zoho Desk, go to Setup → Customization → Buttons and click New Button.
Choose the Tickets module and the ticket detail view, label the button Create SafeHanded request, and choose the action Open a URL (in a new tab).
Paste the link below as the URL. Then delete TICKET_ID at the end and, in its place, click Insert Placeholder and pick the ticket’s Ticket Id.
Save, and choose which profiles can see the button. It appears on each ticket and opens a new SafeHanded request linked to it.

https://safehanded.com/app/requests/new?ticket=TICKET_ID

Settings → Integrations → your Zoho Desk card → Activity shows this link ready to copy.

Choosing a preset (optional). A preset is a saved request — the reason, how long the credential is kept, who receives it and how the link is sent. To start from one, add &preset= and the preset’s slug to the end of the link, for example &preset=password-reset. Each preset’s slug is shown, with a copy button, under Settings → Request presets. With no preset in the link, SafeHanded uses the client’s default preset, then the organisation default (Settings → Policy → Default preset for new requests), and otherwise the policy defaults.

No click at all. Point a Zoho Desk workflow rule’s webhook action at a generic webhook integration’s trigger URL (Settings → Integrations → Generic webhook) with the SafeHanded trigger body; SafeHanded then creates the request with no one present. This needs a second ticketing integration (the generic webhook), which the MSP plan allows; the Team plan includes one ticketing integration. A request created this way is linked through the generic webhook integration, so its close-to-purge follows that integration’s setup, not Zoho Desk’s polling.

4. Status mapping

The default map covers the stock statuses — Open / In Progress / Escalated → open, On Hold → pending, Resolved → resolved, Closed → closed. Custom statuses show as unknown (never purge) until mapped.

5. What technicians see

Private comments (isPublic: false): created · submitted · (optionally) revealed · destroyed · expired · revoked · rotation recommended.
Public comment (if the preset delivers in-ticket): the secure link and a one-line explanation — never the challenge code.
The certificate PDF attached on destruction (if the Attach certificate policy is on).

Troubleshooting

Symptom	Cause / fix
Test connection fails	Check the data centre matches your Zoho account, and the self-client scopes include `Desk.tickets`.
“Unknown status” on the card	Map the status in the status-map editor.