Managing access to the Zendesk API

Users can access the Zendesk API using any of three authentication methods. First, they can use their Zendesk password. This is known as basic authentication. Second, they can use an auto-generated password called an API token. Third, they can use an OAuth access token, which is different than an API token.

All three authentication methods are disabled by default in new accounts. This article explains how to enable and disable each method to manage how users access the Zendesk API.

• Managing password access to the API
• Managing API token access to the API
• Managing OAuth token access to the API

To use any of these authentication methods in API requests, see Security and authentication on developer.zendesk.com.

For information on using the Zendesk API, see the following pages:

• Zendesk developer documentation
• Zendesk API reference
• Zendesk API community

Managing password access to the API

Users can use their Zendesk password to authenticate API requests. Only verified users can make API requests with their password.

Password access to the API is disabled by default in new accounts. You must enable password access in Admin Center before users can use their password.

To enable or disable password access

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. In the Settings tab, enable or disable password access.

To authenticate API requests with Zendesk passwords, see Basic authentication on developer.zendesk.com.

Managing API token access to the API

Users can use an API token to authenticate API requests. API tokens are auto-generated passwords that you can use with your username to authenticate API requests. They can also be used as part of two-factor authentication for integrations. Each API token can be used by any verified user on the account and isn't associated with a specific user. More than one token can be active at the same time.

API tokens are not the same as OAuth access tokens. See Differences between API tokens and access tokens on developer.zendesk.com.

This section includes the following topics:

• Enabling API token access
• Generating API tokens
• Deleting an API token

To use an API token to authenticate API requests, see API token on developer.zendesk.com.

Enabling API token access

API token access is disabled by default. You must enable API token access in Admin Center before users can use API tokens.

To enable API token access

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. In the Settings tab, enable token access.

Generating API tokens

To generate an API token, you must be an administrator and API token access must be enabled in your account.

To generate an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. Click the Add API token button to the right of Active API tokens.

   The token is generated and displayed.

   

3. (Optional) Enter an API token description.
4. Copy the token and paste it somewhere secure. When you click Save to close this window, the full token will never be displayed again.
5. Click Save to return to the Zendesk API page.

   If you click the token to reopen it, a truncated version of the token is displayed.

   

Deleting an API token

An API token is like a password: any verified user on the account or anyone with their email address can use it to authenticate API requests. If you become aware than an API token has been compromised, delete it immediately. Deleting a token deactivates it permanently.

To delete an API token

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. Select the token in the list, then click Delete on the right side.

Managing OAuth token access to the API

You can use OAuth access tokens to authenticate API requests. OAuth provides a secure way for applications to access Zendesk data without having to store and use Zendesk passwords or API tokens, which are sensitive information.

You can't create OAuth access tokens directly in Admin Center like API tokens. You must first create an OAuth client in Admin Center, then use the OAuth client in a defined OAuth authorization flow to create an OAuth access token.

OAuth access tokens are not the same as API tokens. See Differences between API tokens and access tokens on developer.zendesk.com.

This section covers the following topics:

• Creating OAuth clients
• Creating access tokens with an OAuth client
• Deleting OAuth clients and tokens

To authenticate API requests with OAuth access tokens, see OAuth access token on developer.zendesk.com.

Creating OAuth clients

OAuth clients let you create OAuth access tokens that can be used to authenticate API requests. OAuth access tokens differ from API tokens. OAuth access tokens provides a secure way for applications to access the Zendesk API without having to store and use the passwords of your Zendesk users.

To create OAuth clients

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. Select the OAuth Clients tab.
3. To create a client, click the Add OAuth client button and follow the instructions in Registering your application with Zendesk.
4. To delete a client, select the client in the list, then click Delete on the right side.

Next, use the OAuth client to create one or more OAuth access tokens.

Creating access tokens with an OAuth client

After creating an OAuth client in Admin Center, you can use it with a defined authorization flow to create OAuth access tokens. You can use different OAuth authorization flows. For the options, see Implementing an OAuth authorization flow in your application.

You can also use the OAuth client with the API to create access tokens without an authorization flow. You can use a password or an API token to authenticate these API requests. See Creating and using OAuth access tokens with the API on developer.zendesk.com.

Deleting OAuth clients and tokens

You can delete an OAuth client to deactivate all the access tokens created with the client. You can also revoke individual access tokens.

To delete an OAuth client

1. In Admin Center, click Apps and integrations in the sidebar, then select APIs > Zendesk API.
2. Select the OAuth Clients tab.
3. Select the client in the list, then click Delete on the right side.

To revoke a specific access token

• See Revoking an access token on developer.zendesk.com.