| Announced on | Rollout starts |
| January 14, 2026 | April 29, 2026 |
Zendesk is committed to safeguarding your data and aligning with industry-leading security practices. To further improve app security, Zendesk is ending support for the password setting type for third-party credentials in Zendesk apps starting on April 29, 2026.
This announcement includes the following topics:
What is changing?
Beginning April 29, 2026, Zendesk apps will no longer support the password setting type (parameters[].type = "password" in a manifest.json parameters entry) for collecting third-party credentials (such as passwords) during app installation or configuration. To maintain secure authentication flows, developers must update their apps to use more secure authentication methods such as OAuth 2.0. Where OAuth 2.0 isn't supported, you can use basic authentication with a secure setting, which stores the secret securely in the Zendesk infrastructure.
Why is Zendesk making this change?
This update enhances security by reducing risks related to password collection, storage, and handling. It helps protect sensitive customer information and aligns apps with modern security standards. Using secure settings for third-party credentials reduces attack vectors and strengthens overall data protection.
What do I need to do?
Update your app by April 29, 2026, if it collects third-party credentials using a manifest parameter with type: "password". Choose one of the following approaches:
- Use OAuth 2.0 authentication (recommended).
- Use basic authentication with a secure setting to store the secret securely.
If your app currently uses a secure setting with type: "password", update the setting type to text (while keeping it secure). The existing secret is retained and admins won't need to re-enter it.
If you have feedback or questions related to this announcement, visit our community forum where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact Zendesk Customer Support.