Zendesk is phasing out API tokens – here’s what you need to do

What is an API token?

Simply put, an API token is a digital key. It is used by another system to read information from or update data inside Zendesk.

For example, it could be an integration that:

• Retrieves order or customer information
• Creates or updates tickets
• Connects Zendesk with a CRM, inventory, or order system
• Runs an automated script or workflow

This change does not directly affect agents’ day-to-day work. It affects external systems, apps, and scripts that use API tokens to connect to Zendesk’s Ticketing, Help Centre, or Voice APIs, among others.

Why is Zendesk making this change?

API tokens are static and have traditionally lacked an automatic expiry date. They also cannot be restricted to individual API resources in the same way as OAuth.

OAuth offers better options to limit an integration’s access and use time-limited access keys. This reduces the risk if an access key falls into the wrong hands.

Check your API tokens

You can find your API tokens here:

Admin Center → Apps and integrations → APIs → API tokens

A list of the API tokens in the account will be displayed.

The Last used column provides an indication of which tokens risk being deactivated due to inactivity. However, it does not automatically show which integration is using the token.

If it is unclear, you can contact your IT department or us at HappiRel.

The phase-out takes place in three stages

Phase 1 – from 28 July 2026

From 28 July 2026, the following applies:

• API tokens that have not been used for 30 days will be automatically deactivated.
• A deactivated token that remains unused for 60 days will be permanently deleted.
• New Zendesk accounts created from this date cannot create or use API tokens.

When a token is deactivated, it can no longer be used for API calls. An integration using that token may therefore stop working.

Phase 2 – from 27 October 2026

• Existing Zendesk accounts will no longer be able to create new API tokens, either in Admin Center or via the API.

Tokens already active can continue to work until 30 April 2027, provided they are used and not deactivated due to inactivity.

Phase 3 – 30 April 2027

• All remaining API tokens will be permanently deleted
• API tokens can no longer be reactivated
• All API calls using API tokens will stop working
• The pages for managing API tokens will be removed from Admin Center

Is your business affected?

You could be affected if you have ever:

• Built your own integrations, apps, or scripts for Zendesk
• Connected Zendesk to other systems via external tools or partners
• Shared or entered email addresses and API tokens in other tools

Having an API token in Admin Center does not necessarily mean it is still in use. At the same time, an active and business-critical integration may depend on a token whose purpose is not clearly documented.

Therefore, do not remove any tokens before you have identified what they are used for.

What do you need to do?

1. Take inventory of your API tokens and identify what they are used for

Document which API tokens exist, their status, description, and when they were last used. Then check which integrations, apps, scripts, or external systems use each token. Pay particular attention to older integrations that lack a clear internal owner.

2. Appoint a technical responsible person and plan actions

Decide who is responsible for each affected integration and contact the relevant system provider to clarify the following:

• Does the solution use a Zendesk API token?

• Does the solution support OAuth?

• Does the integration need to be updated?

• Who will carry out the migration?

• How will the new connection be tested?

3. Migrate and test the integration

The technical responsible person needs to create an OAuth client, choose a suitable OAuth flow, and update the integration to use OAuth instead of an API token.

API tokens and OAuth can be used in parallel during the transition period. This makes it possible to migrate and test one integration at a time.

Do not remove the old token until the new OAuth connection has been tested and verified.

Reactivating a deactivated token

A deactivated API token can be reactivated as long as it still exists in Admin Center.

A token that has been deactivated and unused for 60 days is permanently deleted and cannot be restored. After 30 April 2027, no API tokens can be reactivated.

To reactivate a token, go to:

Admin Center → Apps and integrations → APIs → API tokens

Open the menu next to the token and select Reactivate.

Reactivation should only be seen as a temporary solution. The integration still needs to be migrated to OAuth.

What happens if you don’t migrate?

Integrations still using API tokens may start returning errors or stop working altogether.

The impact depends on how many of your workflows use API tokens and how business-critical these integrations are.

For more information about the migration, see Migrate from API tokens to OAuth access tokens in Zendesk’s developer documentation.