Plan requirement
| Subscription | Any plan |
| Access | Admin |
API tokens let another system act as your account. Creating one is easy; managing them well is the part that matters.
Create a token
- Open Admin Center, then Apps and integrations, then APIs, then API tokens.
- Add an API token.
- Give it a description saying what uses it.
- Copy the token now. It is shown once and never again.
- Save.
Write a real description
The field that saves you later. In two years you will look at six tokens and need to know which can be revoked. "Integration" tells you nothing; "Finance system, nightly contract sync, owner: Bram" tells you everything.
One token per integration
Sharing one token across three systems means revoking it breaks all three, and you cannot tell which one is making the calls that concern you. Separate tokens cost nothing.
A token acts as a user
It carries the permissions of the account it belongs to, so a token tied to an admin can do anything an admin can. Where the integration only needs to read tickets, tie it to an account with the narrower role rather than to yours.
A token is a password. Not in a shared document, not in a chat message, not in code that goes into version control. It grants access to every customer conversation you hold.
They are being removed, and the dates are set
API tokens are on their way out. New accounts can no longer create them, and from 27 October 2026 nobody can create a new one at all. A token left unused for 30 days is deactivated automatically, and one that has been deactivated for 60 days is deleted. That clear-out has been running since July 2026, so a token you have not touched in a while may already be gone; check before you assume an integration is still authenticated. On 30 April 2027 every remaining token stops working, webhook authentication included. OAuth access tokens are the replacement.
So this page has a shorter purpose than it used to. It is for keeping what you already have working, and for creating a last replacement before the door closes in October. Anything you are building now should use OAuth, and anything already running on a token needs a date in the diary well before April 2027.
Note what the automatic deactivation means in practice: a token used once a quarter is a token that will be gone when you next need it.
A deactivated token can come back, for sixty days
Deactivation is not deletion, and that gap is your recovery window. If an integration stopped working and its token shows Deactivated, open the options menu next to it and select Reactivate. It works again immediately.
You have sixty days from the day it deactivated. After that the token is deleted for good and no reactivation is possible, so the integration needs a new token, or better, OAuth. After 30 April 2027 nothing can be reactivated at all.
The token list also shows a Deactivates on column, which is the honest way to answer “is this still going to work next month”. Zendesk mails all admins before a token deactivates and again before it is deleted, batched into one message a day, so those are worth not filtering away.
Revoke what you do not recognise
Review the list occasionally. A token whose purpose nobody can explain is either unused, in which case revoking costs nothing, or in use by something undocumented, which you need to know about. Deleting one deactivates it permanently, and an account holds up to 256, so there is a practical reason to keep the list short as well as a security one.
Comments
0 comments
Article is closed for comments.