How can I authenticate API requests?

Question

How can I authenticate API requests using one of Zendesk v2 API's?

Answer 

You must be a verified user to make API requests. You can authenticate API requests using basic authentication with your email address and password, with your email address and an API token, or with an OAuth access token.

All methods of authentication set the authorization header differently. Credentials sent in the payload (body) or URL are not processed.

This article includes information on the following topics:

• Basic authentication
• API token
• OAuth access token
• Viewing your authorization header

Basic authentication

If using Basic authentication, you can combine your email address and password to generate the authorization header.

The email address and password combination needs to be a Base-64 encoded string.

The authorization header should be formatted like this:

Authorization: Basic email_address:password

API token

If using an API token, you can combine your email address and API token to generate the authorization header.

The email address and API token combination needs to be a Base-64 encoded string.

The authorization header should be formatted like this:

Authorization: Basic email_address/token:api_token

OAuth access token

If using OAuth to authenticate,  the authorization header should be formatted like this:

Authorization: Bearer oauth_access_token

Please see Using OAuth authentication with your application for more information. 

Viewing your authorization header

If you want to see exactly what's being sent by your app, use a page like http://requestb.in/ to see what's coming over. It's helpful to compare your headers to those being generated by an HTTP target using basic authentication. You can point an HTTP target to the same requestb.in page and choose Test Target to see this in action:

Once that hits your requestb.in, it shows up like this:

 

The string following "Authorization: Basic" is dXNlckBlbWFpbC5jb206b3BlbnNlc2FtZQ== 

This is the base64-encoded version of the username/password. To de-code that manually, head to a page like https://www.base64decode.org/, paste the string into the upper box, and click Decode:

  

If you're using python to make requests, it should be possible to set your session headers as follows:

session = requests.Session()
session.headers = {'Content-Type': 'application/json', 'Authorization': 'Basic Basic_64_encoded_code'}

For more detailed information on authentication, see our developer documentation on Security and authentication.