This part is for whoever builds it.
Every API action is credited to whoever authorized it
Zoho Desk attributes comments, attachments and ticket updates to the user whose OAuth token made the call. There's no field to set the author, so whoever clicked "authorize" becomes the name on every automated comment. Use a dedicated Zoho Desk user for the integration, give it only the access it needs, and name it something your team will recognize. Renaming that user later changes the name on past comments too.
Field labels and API names drift apart
Custom fields have an API name (it starts with cf_) that stays the same when someone renames the label in Zoho Desk. Match on the API name. Code that matches on labels breaks the first time someone tidies up the ticket layout.
Tokens expire hourly
Access tokens last an hour, and every request also needs your orgId header. The integration has to refresh tokens on its own, and you want an alert if a refresh ever fails, because otherwise it just stops quietly.
Treat webhooks as a nudge
Zoho Desk checks the URL when you register a webhook, so it has to be live first, and events can arrive batched in an array. Don't act on the payload itself. Use it as a signal to read the ticket fresh from the API, which also means a forged request can't tell your integration what a ticket says.
Pick public or private on purpose
Comments posted through the API can be public or private. A public one is visible to the customer, so set it explicitly on every automated comment instead of trusting a default.
The Striven side has a lot more of these. We keep a running list in Striven API gotchas.