Managing API token access to the Zendesk API

What's my plan?

Suite

Team, Growth, Professional, Enterprise, or Enterprise Plus

Support

Team, Professional, or Enterprise

Verified AI summary ◀▼

Manage API access to your Zendesk account by generating, editing, deactivating, reactivating, and deleting API tokens. On Enterprise plans, view the audit log for token activities. 

Location: Admin Center > Apps and integrations > APIs > API tokens

Users can use an API token to authenticate API requests. API tokens are auto-generated passwords that you can use with your email address to authenticate API requests. They can also be used as part of two-factor authentication for integrations. Each API token can be used by any verified user on the account and isn't associated with a specific user. More than one token can be active at the same time

You can have up to 256 tokens. If you're at the limit, you must delete an existing token to add a new one. Accounts that currently have more than 256 tokens have a limit of 2048 tokens.

API tokens are not the same as OAuth access tokens. See Differences between API tokens and access tokens on developer.zendesk.com.

This article includes these sections:

• Generating API tokens
• Editing an API token
• Deactivating and reactivating an API token
• Deleting an API token
• Viewing audit logs for an API token (Enterprise)

Generating API tokens

To generate an API token, you must be an administrator and API token access must be turned on in your account.

To generate an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.

   A list of API tokens appears.

   

2. Click Add API token.
3. (Optional) Enter a Description for the token.
4. Click Save to generate the token.

   The token is generated and displayed.

   

5. Copy the token and paste it somewhere secure.
   Note: When you click Save to close this window, the full token will never be displayed again.
6. Click Save again to return to the list of Zendesk API tokens.

   If you click the token to reopen it, a truncated version of the token is displayed.

   

Editing an API token

You can edit an API token to update the token description.

To edit an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.
2. Find the token you want to edit.
3. Click the options menu icon () next to the token and select Edit.
4. Enter a new Description for the token, then click Save.

   

Deactivating and reactivating an API token

In some cases, you may want to temporarily deactivate a token to make sure it hasn’t been compromised, or you might want to deactivate a token to investigate how it's being used without actually deleting it. Deactivated tokens can be reactivated.

To deactivate an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.
2. Find the token you want to deactivate.
3. Click the options menu icon () next to the token and select Deactivate.

   

4. In the confirmation dialog, select Deactivate.

   The token status changes immediately. As soon as you deactivate a token, API calls using that token begin failing.

To reactivate an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.
2. Find the token you want to reactivate.
3. Click the options menu icon () next to the token and select Reactivate.
4. In the confirmation dialog, click Reactivate.

   The token status changes from Deactivated to Active. Reactivating a token restores its ability to authenticate API requests.

Deleting an API token

An API token is like a password: any verified user on the account or anyone with their email address can use it to authenticate API requests. If you become aware that an API token has been compromised, delete it immediately. Deleting a token is permanent. It can’t be undone.

Note: You must deactivate a token first before you can delete it.

To delete an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.
2. Find the token you want to delete and make sure the status is Deactivated.
3. Click the options menu icon () next to the token and select Delete.

   

4. In the confirmation dialog, click Delete.

Viewing audit logs for an API token (Enterprise)

On Enterprise plans, the audit log records activity associated with an API token, including when it was created, deactivated, or reactivated.

To view audit logs

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > API tokens.
2. Find the token in the list.
3. Click the options menu icon () next to the token and select View audit log.

   The audit log opens with a filter applied for the API token you selected. The audit log shows the activities associated with the token.