Obfuscating API keys in an integration for AI agents

<div class="article-banners">
<div id="docs-wmp-link"><a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener noreferrer" target="_blank">What's my plan?</a></div>
<div class="article-banner" id="suite_all"><figure class="wysiwyg-table wysiwyg-table-align-left"><table><tbody><tr>
<td><strong>All Suites</strong></td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr></tbody></table></figure></div>
<div class="article-banner" id="support_all"><figure class="wysiwyg-table wysiwyg-table-align-left"><table><tbody><tr>
<td><strong>Support</strong></td>
<td>Team, Professional, or Enterprise</td>
</tr></tbody></table></figure></div>
</div><div class="body">

<p>Obfuscating API keys in an integration is essential for safeguarding sensitive data and preventing unauthorized access to protected resources. When an API key is entered into the <a href="https://support.zendesk.com/hc/en-us/articles/8357756844442">integration builder</a>, it’s automatically obfuscated to enhance security.</p>
<p>This article contains the following topics:</p>
<ul>
<li data-list-item-id="e6ea570de6f56541a3d3a827eff33ada8"><a href="#h_01JMFDPT00WV0E1VCD75XCAH87">Using an authorization token in a request header</a></li>
<li data-list-item-id="ec2aab5cf40744e5109bc6d75f86995ff"><a href="#h_01JMFDWM747ZVXBSXJR7RTS2Z0">Using an authorization token as a request parameter</a></li>
</ul>
<p>Related articles:</p>
<ul><li data-list-item-id="ecfb8ac81c87be3e79b9fc10551ce2ca2"><a href="https://support.zendesk.com/hc/en-us/articles/8498753675290">Integration builder resources</a></li></ul>
<h2 id="h_01JMFDPT00WV0E1VCD75XCAH87">Using an authorization token in a request header</h2>
<p>For authentication, ensure the authorization token is included in the request headers by referencing it as {{apiToken}}. This setup applies to all authorization types, except for cases with no authorization.</p>
<p>To implement the token within the headers, assign it to the designated header key using the syntax {{apiToken}} for OAuth 2.0, Bearer {{apiToken}} or, for Basic Auth, Basic {{apiToken}}.</p>
<h3 id="h_01JMFDZMVJENPQ28BPWNAJAAQ1">How to:</h3>
<p>In my example below with Authorization type of API Key, I have typed in my API key:</p>
<p><img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_1.png" width="600"></p>
<p>Once I click Save, it will automatically obfuscate the key to &lt;SECRET&gt;:</p>
<p><img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_2.png" width="600"></p>
<p>Now I click Headers. Here, I enter my token key and for the value I enter {{apiToken}}.</p>
<p><img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_3.png" width="600"></p>
<h2 id="h_01JMFDWM747ZVXBSXJR7RTS2Z0">Using an authorization token as a request parameter</h2>
<p>Additionally, a token can be passed as a request parameter, either directly from the widget or from metadata.</p>
<h3 id="h_01JMFE158TB81K4Z4C5P0BPTT8">How to:</h3>
<p>Define a request parameter with a key of your choice.</p>
<p><img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_4.png" width="600"></p>
<p>Once created, this parameter can be dynamically referenced within the headers in the same format as outlined above or it can be posted to an endpoint in the request body/payload.</p>
<p><img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_5.png" width="600"> <img src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/aiaa_obfuscating_api_keys_6.png" width="600"></p>
<p> </p>
<script id="docs-schema-markup" type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/8919243947034",
"url": "https://support.zendesk.com/hc/en-us/articles/8919243947034-Obfuscating-API-keys-in-an-integration-for-advanced-AI-agents",
"headline": "Obfuscating API keys in an integration for advanced AI agents",
"description": "You can protect sensitive API keys in integrations by automatically obfuscating them and using authorization tokens in request headers or parameters for authentication.",
"articleSection": "Integrating other platforms with advanced AI agents",
"datePublished": "2025-02-19T15:40:44+00:00",
"dateModified": "2025-09-05T23:12:40+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/8919243947034"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "AI agents",
"@id": "https://support.zendesk.com/hc/en-us/sections/8988994355994"
}
}
}
</script>
</div>