How can I authenticate API requests?

Important: Zendesk is removing API tokens as an authentication method. Starting July 28, 2026, unused tokens will automatically deactivate. By April 30, 2027, all API tokens will stop working. See Announcing the removal of API tokens as an authentication method for API requests.

Question

How can I authenticate API requests using one of the Zendesk APIs?

Answer

You must be a verified user to make authenticated API requests. To authenticate API requests, use basic authentication with your email address and password, your email address and an API token, or an OAuth access token.

All authentication methods set the authorization header differently. Credentials sent in the payload or URL aren't processed. Each option is listed below:

API token authentication

OAuth access token authentication

Viewing your authorization header

API token authentication

If you use an API token, combine your email address and API token to generate the authorization header. Format the email address and API token combination as a Base-64 encoded string. For an example of how to format the authorization header, see the code block below.

Authorization: Basic {base-64-encoded email_address/token:api_token}

OAuth access token authentication

If you use OAuth to authenticate, format the authorization header this way:

Authorization: Bearer oauth_access_token

For more information, see Using OAuth authentication with your application.

Viewing your authorization header

Warning: Do not send live or production API tokens, OAuth access tokens, or account passwords to third-party request inspection tools or external request bins. Exposing active credentials to external services creates a security risk. Use dummy or mock tokens when testing headers externally.

To see exactly what your app sends, use a third-party page such as Pipedream, formerly RequestBin. Compare your headers to those generated by a webhook using OAuth authentication. Point the webhook to your m.pipedream.net URL and, on the Add webhook page, click Test webhook to see this in action.

After the request hits your requestb.in, it appears like this:

The string after Authorization: Bearer is the API key provided by RequestBin in your account settings under Programmatic Access.

If you use Python to make requests, set your session headers as follows:

session = requests.Session()
session.headers = {'Content-Type': 'application/json', 'Authorization': 'Basic Basic_64_encoded_code'}

Note: Monitor your use of the API with the API Usage dashboard and verify any possible rate limits.

For more information, see the developer documentation: Security and authentication.