Zoho SSO and Access Setup: IT Admin Guide

1. Zoho API Console → Zoho API Console → Add Client → Server-based Applications.
2. Name it Bolt. Grant types: Authorization Code plus Refresh Token.
3. Sign-in redirect URI:
   https://bolt.<yourdomain>/api/auth/callback
4. Sign-out redirect URI: https://bolt.<yourdomain>/
5. Scopes: openid email profile offline_access. Bolt requests nothing else from Zoho.

6. Zoho Directory groups: Control who may sign in from Zoho Directory.
7. Copy the values Bolt needs: Client ID, Client secret, and datacenter com.

A · Setup wizard (no file editing)

The installer and first-run admin wizard walk this step: pick Zoho, paste the values above, click through. Self-hosted installs can instead run enterprise/setup.sh, which writes a .env.prod for you.

B · Configuration file (self-hosted)

APP__PLATFORM__IDENTITY__PROVIDER=zoho
APP__PLATFORM__IDENTITY__DATACENTER=com
APP__PLATFORM__IDENTITY__CLIENT_ID=<client-id>
APP__PLATFORM__IDENTITY__CLIENT_SECRET=<client-secret>
APP__PLATFORM__IDENTITY__REDIRECT_URI=\
  https://bolt.example.com/api/auth/callback

C · SAML 2.0

Zoho is wired over OIDC as above. SAML 2.0 sign-in works on the web; on the desktop app, choosing SAML opens Bolt on the web.

D · Verify

curl https://bolt.example.com/health  → {"status":"healthy", ...}

status is healthy, degraded or critical. Then sign in at https://bolt.<domain> with a corporate account. A failed login names its cause: redirect-URI mismatch, unassigned user, or clock skew.