Overview
Some API-based applications enforce rate limits on their authentication or token endpoints. These limits restrict the number of API requests that can be made within a specific time period.
This article explains how to handle access token rate limiting by securely storing and reusing tokens, using a real-world example from Zoho ManageEngine ServiceDesk Plus ITSM.
Problem
Certain applications impose API rate limits on their token generation endpoints. For example, Zoho ManageEngine ServiceDesk Plus ITSM enforces a rate limit of 10 calls per hour on the OAuth token API (/oauth/v2/token).
This means that the token endpoint can be called a maximum of 10 times within a one-hour period.
In our implementation, multiple workflows required access tokens to invoke ServiceDesk Plus APIs. As the number of workflows increased, the combined token requests exceeded the permitted limit, resulting in workflow failures.
After contacting Zoho Support, it was confirmed that the rate limit is a standard security control and cannot be increased.
Diagnosis
The root cause was that each workflow was independently requesting a new access token by calling the /oauth/v2/token endpoint.
Since the token endpoint was limited to 10 requests per hour, frequent token generation requests quickly exhausted the allowed quota.
To address this issue, a mechanism was required to:
- Generate the access token every hour.
- Store the token in a central location.
- Allow multiple workflows to reuse the same token.
- Prevent excessive calls to the token endpoint.
Solution
To overcome the API rate limit, we implemented a centralized token management approach.
Approach
Create a scheduled workflow that calls the /oauth/v2/token endpoint once every hour.
Store the generated access token in a parameter storage location.
Configure all dependent workflows to retrieve the token from parameter storage instead of generating a new token.
Refresh the stored token every hour through the scheduled workflow.
Flow
Steps
1. Navigate to Admin → Global → Parameter Storage and create a new parameter as shown below.
We selected Entra ID as the parameter type because it allows us to store a single value, which in this case will be the access token. The initial value in the Tenant ID field can be any dummy value. This value will be automatically replaced whenever a new access token is generated and stored.
A parameter acts as a placeholder or storage location for the access token, enabling workflows to retrieve and reuse the token without repeatedly calling the token generation API.
- Create a workflow that calls /oauth/v2/token endpoint and store the access token in the parameter that we have created above. To update the parameter, we are using
https://tenant.api.identitynow.com/v2026/parameter-storage/parameters/{{pamaterId}} endpoint
This workflow has been scheduled to run once every hour.
Attached is the workflow json
ScheduleTokenGenerationWorkflowGlobal20260702.json (4.1 KB)
3. Call the parameter using https://tenant.api.identitynow.com/v2026/parameter-storage/parameters/1fd81d4d-8052-4162-a40f-eba2b64c2088 API to get the updated access token from the other workflows
