Announcing the required expiration of global OAuth access and refresh tokens

<figure class="wysiwyg-table wysiwyg-table-align-left" style="height: 44px; width: 100%;"><table style="border-collapse: collapse; border-style: solid; border-width: 1px; margin-left: 0px; margin-right: auto;"><tbody>
<tr style="height: 22px;">
<td style="border-style: solid; border-width: 1px; height: 22px; width: 33.3333%;"><strong>Announced on</strong></td>
<td style="border-style: solid; border-width: 1px; height: 22px; width: 33.3333%;"><strong>Rollout starts</strong></td>
</tr>
<tr style="height: 22px;">
<td style="border-style: solid; border-width: 1px; height: 22px; width: 33.3333%;">February 2, 2026</td>
<td style="border-style: solid; border-width: 1px; height: 22px; width: 33.3333%;"><span style="color: #000000;">February 2, 2026</span></td>
</tr>
</tbody></table></figure><p>We’re making some changes to the default behavior of new global OAuth clients so that access and refresh tokens automatically expire. Additionally, the current deadline for existing local (non-global) OAuth clients to adopt the refresh token flow has been extended to April 1, 2027.</p><p><span style="font-weight: 400;">This announcement includes the following topics:</span></p><ul>
<li data-list-item-id="e953d99b287cc3fabee11aee0cfaa84b7"><a href="#h_01GD3S97RDYVTAFTQ8WR9878VF" target="_self"><span style="font-weight: 400;">What is changing?</span></a></li>
<li data-list-item-id="e2850dcc08cf79b45a638596bcff95b9b"><a href="#h_01GD3S9GD63FPDGQSEFY88M3ND" target="_self"><span style="font-weight: 400;">Why is Zendesk making this change?</span></a></li>
<li data-list-item-id="e75abf4bccdb4e28ad840624ec2fbc162"><a href="#h_01GD3S9TSPXM7M4WHYKYF4E84M" target="_self"><span style="font-weight: 400;">What do I need to do?</span></a></li>
</ul><h2 id="h_01GD3S97RDYVTAFTQ8WR9878VF"><span style="font-weight: 400;">What is changing?</span></h2><p>As of February 2, 2026, the previously announced change <a href="https://support.zendesk.com/hc/en-us/articles/9182123625370-Announcing-support-for-OAuth-refresh-token-grant-type-and-OAuth-access-and-refresh-token-expirations">requiring global OAuth clients to use the refresh token flow</a> is now in effect. Accordingly, we are enforcing the default TTL (time to live) for access and refresh tokens for (1) all newly created global OAuth clients (also called <a href="https://support.zendesk.com/hc/en-us/articles/9447118302362-Managing-external-OAuth-clients">external OAuth clients</a>) and (2) existing global OAuth clients with no usage, or no usage in the past 3 months. For global OAuth clients with more recent usage, expirations will be applied as part of the ongoing efforts to carry out our <a href="https://support.zendesk.com/hc/en-us/articles/9590471542170-Developer-update-Enhanced-security-guidelines-for-third-party-apps-integrations-and-bots">enhanced security guidelines</a>.</p><p>Additionally, starting April 30, 2026, all newly created local (non-global) OAuth clients will automatically have the same default TTLs applied. The previously announced deadline to adopt the refresh token flow has been extended to April 1, 2027.</p><div><figure class="wysiwyg-table" style="width: 100%;"><table class="wysiwyg-table-resized">
<colgroup>
<col style="width: 25%;">
<col style="width: 25%;">
<col style="width: 25%;">
<col style="width: 25%;">
</colgroup>
<tbody>
<tr>
<td><strong>Token type</strong></td>
<td><strong>Default TTL</strong></td>
<td><strong>Minimum TTL</strong></td>
<td><strong>Maximum TTL</strong></td>
</tr>
<tr>
<td>Access token</td>
<td>30 minutes</td>
<td>5 minutes</td>
<td>48 hours</td>
</tr>
<tr>
<td>Refresh token</td>
<td>30 days</td>
<td>7 days</td>
<td>90 days</td>
</tr>
</tbody>
</table></figure></div><h2 id="h_01GD3S9GD63FPDGQSEFY88M3ND"><span style="font-weight: 400;">Why is Zendesk making this change?</span></h2><p>To strengthen security and align with modern standards, we’re requiring OAuth 2.0 refresh tokens for all global OAuth clients created after February 2, 2026. This ensures access tokens are short-lived and rotated, which greatly reduces the window of opportunity if a token is exposed. With the frequency and sophistication of attacks and data breaches rising worldwide, adopting refresh tokens is an increasingly common industry best practice to limit the impact of credential exposure.</p><h2 id="h_01GD3S9TSPXM7M4WHYKYF4E84M"><span style="font-weight: 400;">What do I need to do?</span></h2><div>If you’re a Zendesk admin managing external OAuth clients for your account, you can review token activity for each External OAuth client:</div><ol data-list-tree="true" data-indent="0" data-border="0">
<li data-list-item-id="ec5409c5861094787a13bae98dc5eb63d">In Admin Center, click  <strong>Apps and integrations</strong> in the sidebar, then select <strong>APIs &gt; External OAuth clients</strong>.</li>
<li data-list-item-id="e7ff29cb79141f61ebada8bebf8c878b0">Find the client in the list whose tokens you want to view.</li>
<li data-list-item-id="e699073b10c4f5f3d98d795251fb4509e">Click the options menu next to the client and select <strong>View token</strong> to see the “Last used at” timestamp<strong>.</strong>
</li>
</ol><div>Any token that has a timestamp older than 90 days before February 2, 2026 is impacted by this change.</div><div> </div><figure class="wysiwyg-image"><img style="aspect-ratio: 3812/1848;" src="https://support.zendesk.com/hc/article_attachments/10270046177818" width="3812" height="1848"></figure><figure class="wysiwyg-image"><img style="aspect-ratio: 3180/1848;" src="https://support.zendesk.com/hc/article_attachments/10270046178202" width="3180" height="1848"></figure><p>If you're a third-party app developer, you can use the following general guidelines to prepare your app for OAuth token expiration and refresh handling. The exact implementation details will vary depending on your application and how it's built. For more information, see <a href="https://developer.zendesk.com/documentation/api-basics/authentication/refresh-token">Working with OAuth refresh tokens</a>.</p><ol>
<li data-list-item-id="efcb3ea1cb2eea8812c071c6d948682d6">Implement the refresh flow so your app can renew access without forcing users to reauthorize. Use the <a href="https://developer.zendesk.com/api-reference/ticketing/oauth/grant_type_tokens/">/oauth/tokens endpoint</a> with <code>grant_type=refresh_token</code> to obtain a new access token. If you use an OAuth client library or package, review its documentation to confirm it supports refresh tokens (and automatic token refresh) and update your configuration or version as needed. Depending on your OAuth client implementation, you may also need to update how you store refresh tokens and handle access token expiration.</li>
<li data-list-item-id="ee285a1783a41d7841203ee96969223d4">Handle the rotation and expiration. Refresh access tokens before they expire (or when an OAuth-authenticated request returns a 4xx response) to avoid interruptions, and replace old refresh tokens when a new one is returned.</li>
<li data-list-item-id="e715c212c755c2f3acb35e926609ab065">Handle failures gracefully. If a request authenticated with OAuth fails, or if a request to refresh the access token is unsuccessful, show users a clear message and prompt them to reauthorize the app so it can obtain a new access and refresh token.</li>
<li data-list-item-id="e1c231fa7f26f34c755d5ac49cc4aa126">Monitor and support the rollout.</li>
</ol><p>If you have feedback or questions related to this announcement, visit our <a href="https://support.zendesk.com/hc/en-us/community/topics">community forum</a> where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact <a href="https://support.zendesk.com/hc/en-us/articles/4408843597850">Zendesk Customer Support</a>.</p>