How can I authenticate API requests?

Question

How can I authenticate API requests using one of Zendesk v2 APIs?

Answer 

You must be a verified user to make API requests. Authenticate API requests using basic authentication with your email address and password, with your email address and an API token, or with an OAuth access token.

All methods of authentication set the authorization header differently. Credentials sent in the payload or URL are not processed.

This article includes information on the following topics:

• Password
• API token
• OAuth access token
• Viewing your authorization header

Password

If you use basic authentication, combine your email address and password to generate the authorization header. The email address and password combination need to be a Base-64 encoded string. Format the authorization header as below.

Authorization: Basic {base-64-encoded email_address:password}

API token 

If you use an API token, combine your email address and API token to generate the authorization header. The email address and API token combination need to be a Base-64 encoded string. Format the authorization header as below.

Authorization: Basic {base-64-encoded email_address/token:api_token}

OAuth access token

If you use OAuth to authenticate, format the authorization header as below.

Authorization: Bearer oauth_access_token

For more information, see this article: Using OAuth authentication with your application.

Viewing your authorization header

If you want to see exactly what is sent by your app, use a third-party page like Request Bin. Compare your headers to those being generated by a webhook using an OAuth authentication. Point the webhook to your requestb.in URL and, on the Add webhook page, click Test webhook to see this in action:

Once that hits your requestb.in, it shows up like this:

 

The string after Authorization: Bearer is the API key provided by RequestBin in your account settings under Programmatic Access.

  

If you use python to make requests, set your session headers as follows.

session = requests.Session()
session.headers = {'Content-Type': 'application/json', 'Authorization': 'Basic Basic_64_encoded_code'}

For more information, see the developer documentation: Security and authentication.