Zoho Mail and Pilotiko: an account connection, with no sending yet
Pilotiko goes through Zoho's Canadian authorization server. For now, the connection stops at authorization.
Today the Zoho Mail connection only lets you authorize Pilotiko with Zoho and see the linked account on the Connections page. No email is read or sent through Zoho. Status: Account connection only: no automatic actions for now. Your booking confirmations therefore don't go through Zoho.
In short
- Authorization server: accounts.zohocloud.ca, Zoho's Canadian data centre.
- Scopes requested: ZohoMail.accounts.READ and ZohoMail.messages.ALL.
- No operation is wired up: no sending, no reading, no sorting.
- The two sending connectors that exist are Gmail and Outlook; there's no Zoho path yet.
What does the Zoho Mail connection do?
It completes the OAuth authorization and stores, encrypted, the access Zoho grants. That's all: no part of Pilotiko uses that access yet to read or send anything.
Zoho spreads accounts across several data centres. The Canadian centre's accounts server is https://accounts.zohocloud.ca [1], and Zoho states that each data centre only holds the data of users who registered at that domain [1]. That's the server Pilotiko calls, so a Quebec business that chose Canadian hosting at Zoho stays in that centre for sign-in.
Zoho names scopes in a "Servicename.scopename.Operation" pattern [2]. Pilotiko asks for ZohoMail.accounts.READ, aimed at reading account details, and ZohoMail.messages.ALL, aimed at every operation on messages. That's broad for a connection that does nothing yet, and it will be revisited before anything is actually wired up.
The request asks for offline access and explicit consent each time, uses PKCE and a single-use state value tied to your business and to you. The framework is standard OAuth 2.0 (RFC 6749) [4].
- ZohoMail.accounts.READ: read Zoho Mail account details, used to show which account is linked.
- ZohoMail.messages.ALL: message operations, requested but unused today.
- Read from Zoho: nothing beyond the authorization response.
- Written to Zoho: nothing.
- Needs a person: not applicable while no action is wired; any future send to a customer will follow Pilotiko's approval rule.
How do you link Zoho Mail to Pilotiko?
- 1
Check your data centre
In Zoho, confirm your account is hosted in Canada (you sign in on a zohocloud.ca address). Pilotiko's connection points to that centre.
- 2
Open the Zoho Mail card
In Pilotiko, Connections, business email group. The card may read "To be enabled by Pilotiko" because the Zoho app isn't registered for every account yet.
- 3
Authorize at Zoho
Sign in at Zoho and read the scope list before you accept.
- 4
Read the status
Back in Pilotiko, the card shows the linked account. The business email group will still ask for a sending account, since Zoho doesn't send anything.
What exists, is being commissioned or is coming with Zoho Mail?
| Feature | Status | Detail |
|---|---|---|
| OAuth authorization via accounts.zohocloud.ca | Account connection only | No automatic actions for now. |
| Confirmations and reminders through Zoho | Coming soon | No Zoho sending connector has been written. |
| Reading the inbox | Coming soon | Not built. |
| Other Zoho data centres (.com, .eu…) | Coming soon | Only the Canadian server is configured. |
Sending through Gmail or Outlook / Microsoft 365 is being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account.
What happens to your confirmations if your mailbox is at Zoho?
Why link Zoho now, and how do you take access back?
Linking Zoho today mostly tells Pilotiko which mailbox speaks for the business. The access is stored encrypted (AES-256-GCM) and no module uses it. If you'd rather grant nothing until something is wired up, that's a sensible call: Quebec's privacy act expects consent given for specific purposes and valid only as long as needed [3].
The same act requires a privacy impact assessment before personal information is communicated outside Quebec [3]. Keeping authorization in Zoho's Canadian centre at least avoids that question for the sign-in step.
To revoke: Connections → Zoho Mail → Disconnect. Tokens are erased on Pilotiko's side and the action goes into the audit log. Then remove Pilotiko from the authorized apps in your Zoho account. See also your rights and our subprocessors.
What are the Zoho Mail connection's limits?
- No actions at all: no sending, reading or filing.
- Only the Canadian centre is called; a Zoho account created in another centre won't go through this server [1].
- Zoho documents scopes as comma-separated [2]; Pilotiko sends them space-separated. That detail gets checked at the first live trial.
- To send from your own address, the written connectors are Gmail and Outlook / Microsoft 365; for text messages, see Twilio.
Frequently asked questions
Does Pilotiko send email through my Zoho Mail account?
No, not today. The Zoho connection stops at authorization and no Zoho sending connector exists. Nothing goes out through Zoho.
Why ask for ZohoMail.messages.ALL if nothing is sent?
The scope was set aside for future message actions. It's broader than an idle connection needs, it's on the list to revisit, and you can hold off on granting it.
My Zoho account is hosted in the U.S. Can I link it?
Not for now. Pilotiko only calls Zoho's Canadian authorization server, and each centre only holds users registered at its own domain.
Will customers be able to reply to me in Zoho?
Yes, if your Zoho address is set as the business address. When Pilotiko's platform sender goes live, messages will carry it as the reply-to.
How can I tell my Zoho connection is active?
The Connections page shows the linked Zoho account. The business email group will still ask for a sending account, which is expected since nothing uses Zoho yet.
Sources
- Zoho Developer, Multi-DC support (Zoho OAuth) (accessed on October 15, 2026).
- Zoho Mail, Using OAuth 2.0 (Zoho Mail API) (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
- RFC Editor (IETF), RFC 6749 : The OAuth 2.0 Authorization Framework (accessed on October 15, 2026).
Read next
Pilotiko integrations
Google Calendar, Outlook, Zoom, Stripe, LinkedIn, Cloudflare, Twilio and more: what each Pilotiko connection does today, with its status read from the code.
Gmail and Pilotiko: booking confirmations sent from your own address
What Pilotiko's Gmail link asks Google for (gmail.send only), what it will send, what needs your approval, and where it stands today. Read before linking.
Outlook and Microsoft 365 with Pilotiko: your busy times and your outgoing mail
How Pilotiko connects to Outlook and Microsoft 365: Graph permissions requested, busy-time reading, sendMail, per-employee consent, real status and revoking.