Hi Calum -- just to clarify, a new request/ticket created by an end user using an OAuth/Bearer token should work.

To simplify the above and using the cURL command line tool, the request would look something like:

curl -v -H "Content-Type: application/json" -H "Authorization: Bearer d482cccebdd482cccebdd482cccebdd482cccebdd482cccebdd482cccebd" https://yourownsubdomain.zendesk.com/api/v2/requests.json -X POST -d '{"request":{"subject":"Test Ticket Subject","comment":{"body":"Test Ticket Body"}}}'

You can quickly generate an OAuth token for the above example using your own account and end-user by:

1. In an incognito browser window, go to https://developer.zendesk.com/requests/new

2. Enter your Zendesk instance's subodomain

3. Click Authorize (then select 'Allow' in the popup window that's displayed if needed)

4. Then copy the entire returned OAuth token

I would not recommend using the "API Token"/Basic authorization approach from a client-side solution -- it exposes your account to possible abuse. By switching out the email address before the "/token" portion, you can impersonate other users. You should only use an API token within the context of a secure server-side solution (one that will not expose the API token to any client agents).