Announced on Rollout starts Rollout ends
June 1, 2026 July 28, 2026 April 30, 2027

Zendesk is removing API tokens as an authentication method. Starting July 28, 2026, unused tokens will automatically deactivate. By April 30, 2027, all API tokens will stop working. You must migrate your integrations to OAuth before the final deadline. This change only affects APIs that currently use API tokens including the Ticketing, Help Center, and Voice APIs. It does not apply to other Zendesk products.

This announcement includes the following topics:

  • What is changing?
  • Why is Zendesk making this change?
  • What do I need to do?
  • Frequently asked questions

 

What is changing?

Zendesk is removing Support API tokens over three phases. The rollout includes auto-deactivation for unused tokens, blocking new token creation, and a final forced deactivation date.

Phase 1 (Starting July 28, 2026): Auto-deactivation 

On July 28, 2026, the following updates take effect:

  • One-time clean up: Any token unused for 30 days or more will be deactivated. Deactivated tokens cannot be used to make API requests. API tokens deactivated for 60 days or more will be deleted permanently. 
  • Auto-deactivation starts: From July 28 forward, any token that goes unused for 30 days will deactivate automatically. If an API token stays deactivated for 60 additional days, it will be deleted permanently. 
  • New accounts blocked: Accounts created on and after July 28, 2026, cannot create or use API tokens. 

You can reactivate deactivated API tokens within the 60-day grace period before they’re permanently deleted. 

Phase 2 (Starting October 27, 2026): Block new token creation 

Accounts can no longer create new API tokens through the UI or API. Existing active tokens remain usable until April 30, 2027 unless deactivated.

Phase 3 (Effective April 30, 2027): Forced deactivation 

All remaining API tokens will be deactivated permanently. Admins cannot reactivate tokens, and the API token management pages will be removed from Admin Center.

 

Why is Zendesk making this change?

Permanent, all-or-nothing API tokens are being replaced with OAuth to give you safer, short-lived, and precisely-scoped access for your API-driven workflows. OAuth is the industry standard for secure API access and provides security capabilities that cannot be retrofitted into the API token architecture. API tokens were designed for convenience, not security—and lack fundamental protections against credential compromise.

The security limitations of API tokens

API tokens lack fundamental security controls:

  • No rotation mechanism: There's no way to cycle credentials proactively as a security practice. Rotating an API token requires revoking the old one and updating every integration manually—forcing you to choose between security hygiene and operational uptime.
  • No granular permissions: An API token can be used to impersonate any user in your account, including admins. You can't scope tokens to specific operations or limit which users they can act as—they provide all-or-nothing account access.
  • No expiration: Tokens remain valid indefinitely as long as they're used. While we're introducing auto-deactivation for unused tokens, an actively exploited credential never expires so an attacker using a stolen token every few days could maintain permanent access.

If a token is compromised through exposed code repositories, leaked credentials, or compromised systems, attackers gain persistent account access. These compromised tokens often remain valid for months before detection.

Why OAuth instead of improving API tokens

Modern authentication requires security features like automatic expiration, credential rotation, and granular scoping—capabilities that depend on a fundamentally different authentication architecture. Adding those protections to API tokens would essentially mean rebuilding them to function like OAuth, just under a different name. More importantly, any improvements to API tokens would still require you to update your API-driven workflows. OAuth is the better place to invest that effort: it’s the industry-standard authentication protocol, actively maintained and continually evolving to address emerging security threats, and it provides the right foundation to build on.

 

What do I need to do?

Review your API tokens now

  1. In Admin Center, click Apps and integrations > APIs > API tokens.
  2. Check the "Last used" date for each token.
  3. Tokens unused for 30 or more days will be deactivated on July 28, 2026.
  4. Review token descriptions to identify what workflows use them.

 

Understand what will break

If you don't migrate in time, any integration using API tokens will stop working. The impact depends on how heavily you rely on API-driven workflows that use API tokens (not OAuth):

  • Webhooks that update tickets or modify data in your Zendesk account
  • Custom scripts for automation or data syncs
  • Third-party integrations built by contractors or external developers
  • Middleware workflows where agents never touch Zendesk UI directly

API calls using deactivated API tokens will return authentication errors. Workflows will stop executing, tickets won't sync, and automated processes may fail silently.

Migrate to OAuth

OAuth is the modern authentication method that replaces API tokens. You'll need to:

  1. Create an OAuth client in Admin Center.
  2. Get access tokens using either the client_credentials or authorization_code grant.
  3. Update your integrations to use OAuth instead of API tokens.

For more information, see Migrating from API tokens to OAuth access tokens in our developer documentation. 

Monitor your API tokens

Starting July 28, you'll have new tools to help manage this transition:

  • "Deactivates on" column in your API tokens page shows when unused tokens will auto-deactivate
  • A usage report in your API tokens page to show the previous 7 days of API requests made with API tokens (generate daily to build rolling history)
  • Email notifications will alert all admins:
    • 5 days before July 28 cleanup (July 23 and July 27)
    • Day 25 and day 29 before a token hits 30 days unused (deactivation warning)
    • Day 55 before a deactivated token is permanently deleted

Use the grace period

Between July 28, 2026, and April 30, 2027, you have time to:

  • Test your OAuth implementations
  • Identify which API tokens are used in which workflows
  • Reactivate deactivated tokens (within 60 days before permanent deletion)
  • Migrate incrementally - you don't need to migrate everything at once

 

Frequently asked questions

What happens on each key date?

Date What happens
July 23, 2026 First email notification: Lists which tokens will be deactivated/deleted on July 28
July 27, 2026 Reminder email (1 day before rollout)
July 28, 2026

Rollout begins:

• One-time cleanup: Tokens unused 30+ days → deactivated; Tokens deactivated 60+ days → deleted

• Auto-deactivation starts: Any token unused 30 days → auto-deactivates going forward

• New accounts blocked: Accounts created on or after this date cannot create API tokens

• UI updates: "Deactivates on" column + usage report available
Ongoing (July 28+)

Email notifications sent at day 25 and day 29 before a token hits 30 days unused (deactivation warning)

Email notification sent at day 55 before a token hits 60 days deactivated (deletion warning)
September 21, 2026 First deletion warning emails sent (for tokens deactivated on July 28)
September 26, 2026 First tokens automatically deleted (tokens deactivated on July 28 that were never reactivated)
October 27, 2026 No one can create new API tokens anymore (existing tokens still work)
April 30, 2027 Final deadline: ALL API tokens stop working permanently, no reactivation possible

Can I prevent my tokens from being deactivated on July 28?

Yes, if you use the token between June 28 and July 28. On July 28, 2026 all tokens are checked for activity. Any token with a "Last used" date more than 30 days ago will be deactivated.

How do I reactivate a deactivated token?

  1. In Admin Center, click Apps and integrations > APIs > API tokens.
  2. Find the deactivated token (status shows "Deactivated").
  3. Click the options menu icon next to the token and select "Reactivate".
  4. The token can immediately be used again.

You can reactivate any deactivated token within 60 days of when it was deactivated. After 60 days, the token is permanently deleted and cannot be recovered. After April 30, 2027, no tokens can be reactivated.


 

How will I know which tokens are about to be deactivated?

Starting July 28, your API tokens page will show a "Deactivates on" column. You'll also receive email notifications sent to all admins:

  • Five days before deactivation (e.g., July 23 for the July 28 cleanup)
  • One day before deactivation (e.g., July 27 for the July 28 cleanup)

For ongoing monitoring after July 28, you'll receive emails at day 25 and day 29 before a token hits the 30-day unused threshold. All emails are batched daily and one email per day lists all affected tokens, not one email per token.

How can I see detailed usage information for my API tokens?

Starting July 28, you can generate a usage report from the API tokens page. The report shows the previous seven days of API requests made with API tokens, or up to 500MB of data, whichever comes first. Generate reports regularly to build a rolling 30-60 day history.

Each row of the report shows one API request with the following information:

  • Timestamp: When the request was made
  • Token identifier: Truncated token ID
  • Token description: The description of the API token (if provided)
  • IP address: Where the request originated from
  • User agent: The client/application that made the request
  • Method: HTTP method (GET, POST, PUT, DELETE, etc.)
  • URL: The API endpoint that was accessed
  • Status code: HTTP response code (200, 404, 401, etc.)
  • User ID & email: The user whose email address was used with the token to make the API request

How to use it:

  • Generate the report every few days to build a rolling 30-60 day history
  • Use IP address and user agent to identify which systems/scripts are using each token
  • Use User ID and email address to identify who is making the API requests
  • Check the URL and method columns to understand what operations the token is performing
  • Cross-reference the token identifier with your token list to identify which token needs migrating

Which API tokens are being removed?

Only Support API tokens are affected. API tokens for Messaging, Chat, and other products are not part of this change.

Do I need to migrate all my tokens at once?

No. You can migrate integrations incrementally. Existing tokens continue working until forced deactivation on April 30, 2027. Prioritize mission-critical integrations first.

What if I have a third-party app that uses API tokens?

For Marketplace apps: As per the developer policies it is not permissible for any third-party app, integration or bot (whether it’s listed on the Zendesk Marketplace or not) to use a customer’s API credentials (API token or a customer’s own OAuth client) to authenticate API calls. Apps that migrate to OAuth will continue working. Apps that don't migrate will stop working when API tokens are deactivated.

For custom apps built by third parties: Contact the developer who built the app and ask them to migrate to OAuth. If the developer is no longer available, you'll need to rebuild or find an alternative solution.

What if my integration runs infrequently (monthly/quarterly)?

If your token hasn't been used in 30 days, it will auto-deactivate starting July 28. The next time your workflow runs, it will fail with an authentication error.

Workarounds:

  • Check your tokens page today and identify tokens that will be deactivated on July 28 (anything unused 30+ days)
  • Use the token once between June 28 and July 28 to prevent initial deactivation
  • After July 28, use the usage report to document which tokens are active
  • If a workflow fails, reactivate recently deactivated tokens and use the usage report to identify which one was needed

How do I know which token caused a failed API request?

Currently, failed authentication requests don't show which specific token was used. If you're troubleshooting after a deactivation:

  1. Check the API tokens page for recently deactivated tokens.
  2. Reactivate all candidates (you have 60 days).
  3. Generate a usage report after your workflow runs to identify which token was used.

What happens if I don't migrate in time?

Starting April 30, 2027, all API calls using API tokens will fail with authentication errors. The impact depends on how you use API tokens:

  • Workflows stop executing
  • Tickets don't sync
  • Reports don't run
  • Automated processes fail

There is no opt-out or extension beyond April 30, 2027. All integrations must migrate to OAuth.

Why can't you just make API tokens better instead of removing them?

The security improvements that OAuth provides (automatic expiration, rotation, and scoping) require a fundamentally different authentication model. Adding these features to API tokens would essentially recreate OAuth with a different name.

Additionally, supporting two authentication methods creates its own security risks:

  • Customers choose the simpler option (API tokens) over the more secure option (OAuth)
  • Security improvements and monitoring must be maintained for both systems
  • Attackers can exploit whichever method has weaker security

By removing API tokens entirely, we ensure all integrations benefit from modern authentication security rather than leaving the less secure option available.

What about webhooks that use API tokens?

Using API tokens in webhooks that call back into your own Zendesk instance is no longer supported and will stop working as part of this EOL. Migrating to action flows may be simpler than OAuth for many use cases. For webhooks that action flows doesn't yet support, you'll need to create an OAuth client and update your webhook to use OAuth access tokens for authentication. If your webhook needs to call back into Zendesk and requires OAuth token refresh behavior, you may need to use middleware or another custom implementation that can handle authentication on your behalf. Alternative migration paths are under evaluation.

What are action flows?

Action flows are user-defined automated sequences of steps that perform actions in Zendesk and external systems based on a defined event that initiates or triggers the workflow. The action flows page in Admin Center includes a visual workflow builder (referred to as the action builder) for creating and editing these workflows. Learn about Understanding the action builder and action flows and Creating action flows to automate processes across Zendesk and external systems.

Action flows benefits:

  • Zendesk actions don't count toward your Zendesk API rate limits (but custom actions in action flows do)
  • Can consolidate multiple webhooks into a single flow
  • Extensible: add third-party calls alongside internal operations
  • Visual workflow builder makes it easier to create and manage multi-system workflows

What webhooks are good candidates for action flows migration

  • Ticket create or update operations
  • User create or update operations
  • Organization create or update operations
  • Custom objects, tasks, approvals, ITAM operations
  • Webhooks using JSON payloads with standard CRUD operations
  • Most standard ticket, user, and organization fields are supported
  • All custom ticket fields are also supported

Can action flows custom actions use API tokens?

No. Action flows have two different authentication models:
  • Zendesk actions. These are operations like tickets, users, and organizations:
    • Don’t require the use of API tokens or OAuth
    • Do not consume your API rate limits
    • Not affected by the removal of Zendesk API tokens
  • Custom actions and external actions:
    • Require explicit authentication (OAuth, API key, or basic authentication)
    • Zendesk API tokens used in custom actions will stop working after EOL
    • Must migrate custom actions to OAuth if calling Zendesk endpoints
    • If you migrate to Action flows and use custom actions that require OAuth, Action flows handles token refresh automatically


 

If you have feedback or questions related to this announcement, visit our community forum where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact Zendesk Customer Support.

Powered by Zendesk