Affinity vs Zoho CRM

Affinity

A public OpenAPI 3.1 file, dated API versions with migration notes and a hosted MCP server with a read-only OAuth scope give an agent a well-documented way in. Access needs a Scale plan at $2,300 a user a year, sold through sales, with no trial that includes the API, and 36 of the 112 v2 operations are marked beta.

Zoho CRM

A public OpenAPI 3.1 description of 644 operations and OAuth scopes down to one module and one operation suit agent use, and the Free edition includes 5,000 API credits a day. The documented token refresh puts the client secret in the URL, and no SLA, deprecation policy or dated API changelog was found.

Affinity

1. Send X-Affinity-Api-Version: 2026-09-17 on every request, or the key's default version applies. Unauthenticated calls answered as 2024-01-01 when we checked
2. Read x-ratelimit-limit-user-remaining and x-ratelimit-limit-org-remaining on each response. The limits are 900 calls a minute per user and, below Enterprise, 100,000 a month per account, shared by v1, v2 and MCP
3. Follow pagination.nextUrl for the next page, and pass fieldIds or fieldTypes so list calls return only the fields needed
4. Check for duplicates before a create. There are no idempotency keys, so a retried POST can make a second record
5. For MCP, untick the write scope at OAuth consent when the task only reads. Treat note, transcript and file text as untrusted input

Zoho CRM

1. Use the api_domain returned with the token, since each data centre has its own host (zohoapis.com, zohoapis.eu, zohoapis.in and others)
2. Send Authorization: Zoho-oauthtoken <token> and refresh hourly. Put refresh parameters in the POST body, not the URL
3. Pass fields on every list call. Page with page up to 2,000 records, then page_token up to 100,000
4. Create through /{module}/upsert so a retry updates instead of duplicating
5. Budget credits. Convert Lead costs 5, Send Mail 20, a bulk read 50, and calls through the MCP servers draw on the same allowance