Workflow: How can I use OAuth to authenticate Zendesk API calls in custom actions?

To authenticate Zendesk API calls in custom actions you must create a connection, similar to what is described in Creating connections to integrate with external services.

This workflow includes the following steps:

Step 1: Create the Zendesk OAuth client

Step 2: Add Zendesk client as a Connections client

Step 3: Create the Connection

Step 4: Use the Connection in a Custom Action

Step 1: Create the Zendesk OAuth client

In Admin Center, click Apps and integrations in the sidebar, then select APIs > OAuth clients.

Click Add OAuth client on the right side of the OAuth client list.

Set the Client kind to Confidential.

Set the redirect URL to https://zis.zendesk.com/api/services/zis/connections/oauth/callback.
The subdomain is always zis, not your account subdomain.

Click Save.
After the page refreshes, a new pre-populated Secret field appears on the lower side. This is the client_secret value specified in the OAuth 2.0 spec.

Copy the Secret value to your clipboard and save it somewhere safe.
Since the characters may extend past the width of the text box, be sure to select everything before copying. For security reasons, your secret displays fully only once.
After clicking Save, you only have access to the first nine characters.
For a full description of the fields mentioned in this step, see Using OAuth authentication with your application.

Step 2: Add Zendesk client as a Connections client

In Admin Center, click Apps and integrations in the sidebar, then select Connections > OAuth Clients.

Click Add client on the right side of the Connections OAuth client list.

Set the OAuth grant type to Client credentials.

Add the client ID and secret from your Zendesk client created in Step 1.

Set the Token URL to: https://{your_subdomain}.zendesk.com/oauth/tokens.

Enter a space-separate list of default scopes.
Scopes are permissions that represent what a client application can access on behalf of the user. It is recommended to only set the minimum necessary scopes for your end goal (avoid using the blanket read/write unless necessary). The available scopes are documented here.

Click Save to create the client

Client credentials is preferred in this case as Connections live on Zendesk directly, auto-refreshes itself and already has access to the secret. Short lived token produced by Client credentials grant are more suited to this form of access.

Authorization code is also supported, but your admin will need to enable the connection, and if the connection is unused for a sufficiently long and the refresh_token expires, your connection will break and will need to be re-authorized.
If you want to use this Authorization code, you will need to set the Authorize URL to: https://{your_subdomain}.zendesk.com/oauth/authorizations/new.

Step 3: Create the Connection

In Admin Center, click Apps and integrations in the sidebar, and select Connections > OAuth Clients.

Click Create connection.

Set the Authentication type to OAuth2.0.

Set the scopes you want for this specific connection, or leave blank to inherit the default scopes from the client.

Set the Allowed Domain to your Zendesk account URL {your_subdomain}.zendesk.com

Click Save.

If you've chosen Authorization code, you will be redirected to the OAuth authorization screen.
Click Allow to finalize the flow.

Step 4: Use the Connection in a Custom Action

The connection you created in step 3 is available in the Authentication dropdown when you create a custom action.

If you edit an existing custom action to include this authorization, you must re-add it to any action flows where it is used. Changes to custom actions do not automatically reflect in any action flows that include it.