Plan requirement
| Subscription | Any plan |
| Access | Admin |
With an OAuth access token. API tokens still work, but stop working entirely on 30 April 2027.
How do I authenticate an API request?
With an OAuth access token, sent as Authorization: Bearer {token}. It is valid for the one Zendesk instance whose OAuth client issued it. Zendesk's note is blunt: customers using basic authentication or API tokens will have to move to OAuth for security and compatibility with future requirements.
API tokens, and what they cost you
They still work. Send {email}/token:{api_token} as basic authentication. They are auto-generated passwords, so anybody holding one can act as anyone in the account, admins included. An account can hold 256; delete the unused, and any you suspect.
Deprecated now has dates. New accounts cannot create tokens, from 27 October 2026 nobody can, and on 30 April 2027 all of them stop working, webhooks included. Unused for 30 days and a token deactivates itself; 60 days later it is deleted.
Distributing something to other customers
Then global OAuth tokens are not a preference but a requirement, because the Developer Terms forbid a customer sharing their API credentials with you.
What decides how much damage a leak does?
The account behind the credential. It carries that user's permissions, so one tied to an admin can do everything an admin can, deletion included. Put an integration on its own account with no more access than the job needs. That single step is the difference between a leaked credential being awkward and being serious.
Two practical differences
Browser-side requests from another origin work with an OAuth token and not with an API token. And neither belongs in a repository, a shared configuration file or a chat message: either one opens every customer conversation you have.
Comments
0 comments
Article is closed for comments.