Plan requirement
| Subscription | Any plan |
| Access | Admin |
Three ways to authenticate against the Zendesk API, and which to pick for what you are building. One of them you should not use.
The three
- API token. Tied to a user account, created in Admin Center. Simple, and right for a server-to-server integration you control.
- OAuth. The user grants access to an application. Right when the thing calling acts on behalf of different people, or when you are distributing an app.
- Basic authentication with a password. Exists, and should not be used. A token is better in every respect and can be revoked without changing anyone's password.
Which to pick
Your own script or integration: an API token, on an account with no more permission than the job needs.
An app other people install: OAuth. Each customer grants their own access and can withdraw it.
The account behind the token matters
A token carries the permissions of its user. One tied to an admin can do anything an admin can, including delete. Where the integration only reads, put it on an account with a narrower role.
This is the step most often skipped, and it is the difference between a leaked token being awkward and being serious.
Keep them out of code
Not in a repository, not in a configuration file that gets shared, not in a chat message. A token grants access to every customer conversation in your account.
Comments
0 comments
Article is closed for comments.