Meta tags:
description=Developer documentation for products at Zendesk;

Headings (most frequently used words):

token, authentication, on, this, page, oauth, access, security, and, introduction, api, global, end, user, ssl, requirements,

Text of the page (most frequently used words):
the (39), api (39), zendesk (27), token (27), oauth (24), tokens (24), you (23), #access (21), for (15), and (14), requests (13), use (12), end (11), can (11), authentication (11), users (10), global (9), must (8), with (8), authorization (8), are (8), see (7), more (7), developer (6), your (6), client (5), ssl (5), center (5), user (5), make (4), tls (4), requirements (4), password (4), email (4), this (4), information (4), example (4), credentials (4), curl (4), side (4), one (4), basic (4), delete (4), security (4), terms (3), support (3), admin (3), closed (3), instances (3), view (3), help (3), authenticated (3), endpoints (3), using (3), their (3), create (3), not (3), plan (3), making (3), customers (3), from (3), bearer (3), com (3), different (3), following (3), format (3), header (3), used (3), add (3), request (3), have (3), page (3), section (3), introduction (3), community (2), through (2), sure (2), supports (2), sni (2), connections (2), also (2), account (2), lets (2), instance (2), where (2), any (2), endpoint (2), that (2), integrations (2), app (2), integration (2), bot (2), multiple (2), authenticate (2), prohibits (2), sharing (2), gerypplm4dovggrva1zzmh5mq3nlo8bo (2), https (2), obscura (2), json (2), test (2), follows (2), cross (2), origin (2), browser (2), email_address (2), 6wiibwbgkbmo1mrdmuvwkw1epsnkeuj95piz2akv (2), 256 (2), limit (2), existing (2), currently (2), than (2), apis (2), passwords (2), another (2), which (2), next (2), supported (2), zendev_horizontal (2), system, status, privacy, notice, 181, fremont, street, 17th, floor, san, francisco, california, 94105, slack, blog, forum, join, our, connect, library, both, extension, all, protocol, was, removed, june, 2018, only, regardless, how, configured, setting, explicitly, enable, disable, turning, off, sign, certain, such, enabled, allows, securely, update, own, options, open, without, signing, require, lists, anonymous, permissions, list, articles, interact, two, ways, anonymously, requirement, doesn, apply, developing, applications, internal, available, may, regular, because, set, 184, characters, long, access_token, specify, permit, guide, gives, single, flows, learn, authenticating, over, http, url, encode, slash, character, protected, amrvzublegftcgxllmnvbs90b2tlbjo2d2ljqldir2tctw8xbvjetxvwd2t3muvqc05rzvvqotvqsxoyywt2, after, base64, encoding, resulting, string, jdoe, api_token, sent, new, accounts, 2048, managed, interface, active, same, time, deleting, deactivates, permanently, apps, impersonate, anyone, including, admins, keep, them, secure, unused, once, suspect, been, compromised, necessary, option, described, warning, detailed, auto, generated, differences, between, topics, covered, uses, tutorial, cors, third, parties, distributing, details, customer, continue, now, however, recommends, switching, method, improved, note, authorize, against, address, verified, undocumented, change, policy, pagination, data, types, rate, limits, availability, examples, document, conventions, home, search, reference, documentation, docs,

Text of the page (random words):
security and authentication zendesk developer docs zendev_horizontal zendev_horizontal documentation api reference search introduction home introduction introduction developer community document conventions examples plan availability security and authentication rate limits requests data types pagination change policy undocumented apis on this page api token oauth access token global oauth access token end user authentication ssl requirements security and authentication on this page api token oauth access token global oauth access token end user authentication ssl requirements you must be a verified user to make api requests you can authorize against the api using your email address and an api token or with an oauth access token note if you re an existing zendesk customer and are currently using basic authentication you can continue to use basic authentication for now however zendesk recommends switching your authentication method to api tokens or oauth tokens for improved security if you plan on distributing an app integration or bot to multiple zendesk customers you must use global oauth tokens to authenticate zendesk api requests see global oauth tokens for details the zendesk developer terms prohibits you from sharing your api credentials with third parties client side cors requests are supported if the request is authenticated with an oauth access token the requests are not supported if the request uses a zendesk api token for more information and a tutorial see making cross origin browser side api requests topics covered in this section api token oauth access token global oauth access token ssl requirements for more information see differences between api tokens and oauth access tokens api token api tokens are different from oauth tokens which are detailed in the next section api tokens are auto generated passwords in the zendesk admin center warning as passwords api tokens can be used to impersonate anyone in the account including admins make sure to keep them secure delete any unused tokens delete a token at once if you suspect it s been compromised and create another one if necessary another option is to use oauth tokens which are described in the next section api tokens are managed in the admin center interface at apps and integrations apis zendesk api the page lets you view add or delete tokens more than one token can be active at the same time deleting a token deactivates it permanently you can have up to 256 tokens if you re at the limit you must delete an existing token to add a new one accounts that currently have more than 256 tokens have a limit of 2048 tokens basic authentication is used for api tokens the credentials must be sent with the request in an authorization header use the following format for the credentials email_address token api_token example jdoe example com token 6wiibwbgkbmo1mrdmuvwkw1epsnkeuj95piz2akv after base64 encoding the resulting string add it to the authorization header as follows authorization basic amrvzublegftcgxllmnvbs90b2tlbjo2d2ljqldir2tctw8xbvjetxvwd2t3muvqc05rzvvqotvqsxoyywt2 if you use curl to test different endpoints you can use the following format curl https obscura zendesk com api v2 users json u email protected token 6wiibwbgkbmo1mrdmuvwkw1epsnkeuj95piz2akv if authenticating over http url encode the slash character in email_address token as 2f oauth access token the zendesk api supports oauth authorization flows learn more an oauth token gives access to a single zendesk instance the one with the oauth client used to create the token oauth access tokens also permit client side api requests see making cross origin browser side api requests in the zendesk api guide in your requests specify the access token in an authorization header as follows authorization bearer access_token example authorization bearer gerypplm4dovggrva1zzmh5mq3nlo8bo if you use curl to test different endpoints you can use the following format curl https obscura zendesk com api v2 users json h authorization bearer gerypplm4dovggrva1zzmh5mq3nlo8bo access tokens can be up to 184 characters long global oauth access token if you plan on making an app integration or bot available to multiple zendesk customers you must use global oauth access tokens to authenticate zendesk api requests you may not use regular api tokens or oauth tokens because the zendesk developer terms prohibits zendesk customers from sharing their api credentials with you for more information see set up a global oauth client the requirement to use global oauth tokens doesn t apply if you re developing applications or integrations for internal use end user authentication end users can interact with the zendesk api in two ways anonymously or authenticated with email and password in open instances where users can access the help center without signing in end users do not require authentication for any api endpoint that lists anonymous permissions an example is the list articles endpoint in a closed zendesk instance where end users must sign in to view your help center end users can make authenticated requests to certain api endpoints such as api v2 requests using their email and password if password access for end users is enabled this allows end users to securely create view or update their own requests through the api for more information on closed zendesk instances see options for end user access in zendesk help a setting in admin center lets you explicitly enable or disable password access for end users in closed instances see turning on and off api access ssl requirements the zendesk v2 api an ssl only api regardless of how your account is configured all connections to the zendesk api must support the tls 1 2 protocol support for tls 1 0 and 1 1 was removed in june 2018 connections to the api must also support the sni extension to tls if you connect to zendesk through a client library make sure it supports both tls 1 2 and sni join our developer community forum blog slack zendesk 181 fremont street 17th floor san francisco california 94105 privacy notice zendesk developer terms system status