Integrating UAE Business Systems Through APIs

API integration in the UAE usually means connecting four kinds of system that were never designed to talk to each other: a CRM such as Zoho, an accounting package such as TallyPrime, a payment gateway, and a courier or e-commerce platform. The connection itself is rarely the hard part. What decides whether an integration survives its first quarter is how it handles expiring tokens, rate limits, duplicate events and the reconciliation at month end. This article walks through each of those using the vendors’ own published limits, so you can judge a proposal or a developer’s plan before you pay for it.

Key takeaways

• Zoho CRM access tokens are valid for one hour, and the N-Genius payment gateway issues tokens that expire after 300 seconds, so any integration that stores a token once and reuses it will fail.
• Zoho CRM allows 50,000 API credits every 24 hours plus a per-licence allowance that depends on the edition, and it returns a TOO_MANY_REQUESTS error when the limit is reached.
• TallyPrime exposes data through an HTTP server that runs inside the application itself, on port 9000 by default, which puts your accounting integration on an office machine rather than in the cloud.
• Stripe retries failed webhooks for up to three days in live mode, may deliver the same event more than once, and does not guarantee the order of events.

Decide which system owns each record before anyone writes code

Many of the integration problems we are asked to fix trace back to one unanswered question: which system is the source of truth for a given field? If a customer’s phone number can be edited in Zoho CRM and in the invoicing screen of Tally, and both push changes to each other, the integration will eventually overwrite a correct number with an old one.

For a typical Dubai trading company the split usually looks like this. The CRM owns contacts, leads and deal stages. The accounting system owns invoices, credit notes, tax amounts and ledger balances. The payment gateway owns the fact that money moved. The courier owns the shipment status. Data flows from the owner outward, and the receiving systems treat those fields as read-only.

Write this down as a one-page field map before the build starts. It should list each field, the owning system, the direction of sync, and what happens when a record is deleted. A developer who cannot produce that page has not yet understood your business, however good the code is.

Authentication: tokens that expire while nobody is watching

Most business APIs exchange a long-lived credential for a short-lived access token, and the expiry times are shorter than many people assume.

Zoho’s developer documentation for CRM API version 8, read on 27 September 2026, states that each access token “is valid for only an hour”. The refresh token used to get a new one does not expire, which makes it the most sensitive secret in the whole integration. It belongs in a secrets store on the server, never in a spreadsheet, a shared email or the source code.

Network International’s N-Genius Online, a payment gateway offered to UAE merchants, is stricter. Its documentation, read the same day, shows the access token response carrying “expires_in”: 300, which is five minutes. A payment integration that requests one token at the start of a long batch job will find it rejected partway through.

One Zoho detail catches UAE businesses in particular. Zoho runs separate data centres, each with its own accounts server, and its OAuth documentation lists the US, EU, India, Australia, Japan, Canada, Saudi Arabia and the United Kingdom. There is no UAE entry on that list. A Dubai company may therefore sit on any one of several data centres depending on when and how the account was opened. Zoho’s authorisation response returns an api_domain value precisely so that the integration sends requests to the right place. Code that hardcodes zohoapis.com works in testing against one account and fails for the next client on a different data centre.

Rate limits, and why the nightly sync fails in week three

Rate limits rarely show up in development, because test data is small. They show up with real volumes.

Zoho CRM measures usage in API credits over a rolling 24-hour window. The published allowance, read on 27 September 2026, is 50,000 credits plus a per-user-licence amount that depends on the edition:

A Professional account with 10 users therefore has 55,000 credits a day on the published formula, before any add-on credits are bought. That sounds generous until an integration polls the CRM every minute for changes, which is 1,440 calls a day for one query on one module before any real work is done. Heavier operations such as lead conversion, search and bulk updates also carry a separate concurrency ceiling of 10 across every edition.

The design answer is to stop polling where the vendor offers notifications, batch writes where the API allows it, and treat a TOO_MANY_REQUESTS response as a signal to back off and retry later rather than as a fatal error. An integration that crashes on a rate-limit response loses whatever it was carrying at that moment.

TallyPrime is a desktop application, and that changes the architecture

Many UAE trading and distribution businesses keep their books in Tally, and it behaves nothing like a cloud API. Tally’s own XML integration guide, read on 27 September 2026, explains that you enable the HTTP server from the application’s advanced configuration settings, and that “the default port is 9000”. Requests are posted to the IP address of the machine running TallyPrime.

In practice that means the accounting endpoint lives wherever Tally is installed, which for many SMEs is a desktop or a small server in the office. If that machine is switched off on a Friday, the integration has nothing to talk to. It also means that someone will eventually suggest opening port 9000 to the internet so that a cloud service can reach it. That is a poor idea. The safer pattern is a small connector running on the same network as Tally, which reads and writes locally and makes outbound connections to your cloud systems, so nothing inbound has to be exposed.

The data format depends on the version. Tally’s documentation states that “from TallyPrime 7.0 onwards” JSON exchange is available natively alongside XML. Businesses on older releases are working with XML envelopes, which is slower to build against and is worth knowing before you accept a quote that assumes JSON. Check the installed version before the estimate, not after.

Payments: duplicates, ordering and the reconciliation nobody scoped

Payment integrations fail quietly: an order is marked paid twice, or a refund never reaches the accounts.

Stripe, which lists the United Arab Emirates among its supported countries, documents three behaviours that apply in some form to most gateways. Its webhook documentation, read on 27 September 2026, says Stripe attempts delivery “for up to three days with an exponential back off in live mode”. It says endpoints “might occasionally receive the same event more than once”. And it says Stripe “doesn’t guarantee the delivery of events in the order that they’re generated”, so a paid notification can arrive before the invoice-created notification it relates to.

Each of those turns into a rule for the build. Store the ID of every event processed and ignore repeats. Never assume order; fetch the current state of the object when something arrives out of sequence. Return a success response quickly and do the slow work, such as posting to the ledger, in a queue afterwards, because Stripe’s own guidance is to return a 2xx status “before any complex logic that might cause a timeout”.

Outgoing requests need the same care. Stripe supports an idempotency key on every POST request so that a retried call after a network drop does not create a second charge or customer. Keys can be pruned once they are at least 24 hours old, so a retry scheduled for the following day is a new request as far as the gateway is concerned.

Then there is reconciliation, which is the part most quotes leave out. The gateway settles in batches, net of fees, often a few days after the sale. The accounting entry needs to match the settlement, the fee, any VAT on the fee, and each underlying order. If you are preparing for the UAE’s structured e-invoicing rollout, our guide to what UAE businesses need to do for e-invoicing explains why invoice data quality matters more once invoices are exchanged electronically.

Where the customer data travels, and the UAE law that follows it

An integration copies personal data between systems, and often between countries. The UAE’s Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data, which the UAE Legislation portal lists as effective from 2 January 2022, applies to controllers and processors in the UAE processing personal data of people inside and outside the country. Articles 22 and 23 set the conditions under which personal data may be transferred abroad, including a contract obliging the recipient to apply the law’s controls, or the explicit consent of the person concerned.

Article 2 also excludes certain cases, including companies in free zones that have their own personal data protection legislation. So a business in a financial free zone with its own data law and a mainland LLC can face different rules for the same integration. That is a question for your legal adviser, but your developer should be able to say which fields go to which country.

The practical step is an inventory: for each system, what personal fields it receives and where its data centre is. It is a short document and it saves a painful conversation later.

What breaks in production, and how to notice before your customers do

One issue we often see is the silent failure. The integration stops, nothing crashes visibly, and the first sign is a customer asking why their delivery has not moved or a salesperson finding a paid order still shown as open in the CRM.

The causes are unglamorous. Someone renames or deletes a custom field in the CRM that the integration writes to. A user who authorised the connection leaves the company and their account is disabled, taking the token with it. A vendor retires an old API version. The office machine running Tally gets a Windows update and restarts overnight.

Three safeguards cover most of this. Every failed call is logged with the record it concerned, and failures go to a holding queue that can be replayed rather than being dropped. A daily check compares counts across systems, for example orders paid in the gateway against invoices raised in accounts, and alerts a named person when they differ. And the integration authenticates as a dedicated service user rather than as an employee, so staff changes do not cut it off. Secrets and service accounts deserve the same care as any other access; our note on API security practices covers authentication and authorisation in more depth.

Custom code, a ready-made connector, or middleware

Not every integration should be custom built. It depends on how standard the process is and what a day without the sync would cost.

For a small business with a single online store and a cloud accounting package, a ready-made connector is usually the sensible and cheaper answer. Custom work starts to pay for itself when the process is specific to your business, when Tally sits on premises, or when a failed sync has a direct cost in stock or cash. When it does, it is a custom software development project in its own right, with a specification, testing and a support arrangement, not a quick favour from whoever built the website.

If you are planning to connect a CRM, accounts, payments or deliveries and want a second opinion on the field map or a quote before committing, our team handles payment gateway integration and wider system integration work for UAE businesses, and we are happy to review what you already have.

API limits, token lifetimes and webhook behaviour were read from Zoho, Tally Solutions, Network International and Stripe documentation on 27 September 2026 and change over time; legal references are to Federal Decree by Law No. 45 of 2021 as published on the UAE Legislation portal. This is general information, not legal or technical advice for your specific systems. Cover photo: Dubai Creek Harbour, Dubai, UAE by Lxs, via Wikimedia Commons (CC BY 4.0).