Important update: Password access for APIs will soon be removed

Previously announced on | Removal on
July 31, 2024 | January 12, 2026

As previously announced, Zendesk will stop accepting email and password as an authentication method for API requests beginning on January 12, 2026, for all customers. If you are actively using this method today, you will be able to continue until January 12, 2026, when the method will begin to be phased out in all remaining Zendesk accounts over a period of 10 days. You must switch to using API tokens or OAuth before January 12, 2026 to avoid any impact due to this removal.

This article contains the following topics:

Why is Zendesk making this change?

Are any alternatives available?

What do I need to do?

Why is Zendesk making this change?

Your account security is our top priority. The ability to authenticate API requests with an email and password is inherently insecure as passwords can be compromised and reused, and this method no longer aligns with modern best practices for API authentication. Removing the ability to use the same email and password for API access mitigates the risk of unauthorized access and changes to your account in case your credentials are compromised.

Are any alternatives available?

Yes. The simplest alternative is using an API token. You just need to update your request to use the following format:

{email_address}/token:{api_token}

Each API token can be used by any verified user on the account and isn't associated with a specific user. Permissions are limited by the user role associated with the provided email address. Learn more about managing API token access.

Zendesk also supports OAuth authorization flows. OAuth provides a secure way for your application to access Zendesk data. To use OAuth authentication, you need to register your application with Zendesk. You also need to add some functionality to your application to support the OAuth authorization flow. Learn about using OAuth with your application and working with OAuth.

Learn more about Understanding the differences between API tokens and OAuth access tokens.

What do I need to do?

If you currently have the Password Access for APIs setting turned on but are not using the capability, you can safely turn the setting off. You can find it in Admin Center under Apps and Integrations > APIs > API configuration. After it's turned off, the setting will be removed from the page.

Using API Tokens

Using API tokens is the simplest alternative, and in most cases, the person associated with the email address being used for API authentication should simply be able to replace the password with a token in their application by doing the following:

Turn on API token access.

Follow the steps in Generating API tokens to generate and copy an API token.

Navigate to your application.

Update your application's API authentication credentials:
Username: {email_address}/token
Password: {api_token}

If your application asks for credentials in a single "username:password" value, use:

{email_address}/token:{api_token}

After your applications have been updated, return to Admin Center > Apps and Integrations > APIs > API configuration and turn off Password access.

Using OAuth access tokens

You can authenticate API requests by using an OAuth access token as a Bearer token in the request’s Authorization header. Learn more about working with OAuth. If the access token expires, use the OAuth refresh token grant type to get a new token by sending a refresh_token to the /oauth/tokens endpoint. If refreshing fails or no refresh token is available, redirect the user to re-authorize your app. Learn more about working with OAuth and the authorization code grant flow.

If you have feedback or questions related to this announcement, visit our community forum where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact Zendesk Customer Support.