Signatoro for Zoho Mail: admin guide

This page is for whoever looks after Zoho Mail at a company where people install their signature with Signatoro. The steps for the person installing are in How to add a signature in Zoho Mail.

Signatoro is listed on the Zoho Marketplace as Signatoro signature for Zoho Mail, published on 2026-10-26 after Zoho's security, functional and content review. It works with Zoho accounts in every Zoho data center except China (zoho.com.cn).

What the install does

Each person connects their own Zoho Mail and approves access on Zoho's consent screen. They start from their Signatoro signature page, with "Install into my Zoho Mail", or, when a company invites them at a Zoho Mail address, from "Join and install in Zoho Mail" in the invitation. Signatoro then:

1. Reads the person's Zoho Mail account to find the address they send from.
2. Adds a signature named "Signatoro" to their Zoho Mail settings.
3. Sets it for new emails from that address, placed above the quoted text in replies.

After that, each change to their signature is written to the same signature in Zoho Mail, whether the person made it or their company did. Signatoro updates the signature it created, found by its id, and leaves every other signature in the mailbox as it is.

Permissions Signatoro asks for

The Zoho consent screen lists three permissions:

Signatoro calls only the account and signature endpoints of the Zoho Mail API, for the person who connected.

What Signatoro stores

For each connected person, Signatoro keeps:

• the address the signature is set for, and the Zoho data center of the account
• the refresh token from Zoho, encrypted with AES-256-GCM under a key used only for Zoho tokens
• the current access token, encrypted the same way, until it expires within the hour
• the id of the signature it created, when it last wrote it, and the error from the last write that failed, if any

When Signatoro writes to Zoho Mail

• When the person saves their signature in Signatoro.
• When a company owner changes the company's logo, colors, layout or details, or that person's name, title or phone.
• Once an hour, a check writes any change that has not reached Zoho Mail yet, such as a plan that ended, and retries a write that failed.

On a company's member list in Signatoro, the owner sees who has Zoho Mail connected: "Zoho Mail: updates itself", "Zoho Mail: retrying" after a failed write, or "Zoho Mail: reconnect needed".

If Zoho stops accepting the token, Signatoro stops writing and asks the person to reconnect on their signature page.

How to stop it

The person clicks "Disconnect" on their Signatoro signature page. Signatoro revokes the token at Zoho and deletes what it stored. The signature stays in Zoho Mail as it is.

Deleting the Signatoro account deletes the stored tokens with it. The access then stays listed under Zoho's "Connected Apps" until someone revokes it there, but Signatoro holds nothing that can use it.

In Zoho, the person signs in at accounts.zoho.com, opens "Sessions", scrolls to "Connected Apps", hovers over Signatoro and clicks "Revoke Access". At its next write Signatoro finds the access revoked, shows "Reconnect" on their signature page and writes nothing more. Zoho's help covers this in Sessions.

To remove the signature itself, delete "Signatoro" in Zoho Mail under Settings > Signatures.

Questions

Write to support, or read the FAQ.

Sources

Checked against Zoho's own pages on 2026-09-29:

• POST - Add user signature
• Sessions | Zoho Accounts
• I gave a third-party website access to my Zoho account. How do I revoke the access?