Zendesk stops new API tokens on October 27. Find out what still runs on one.

Zendesk

Existing tokens keep working until April 30, 2027. The catch is the token nobody remembers creating, because after October 27 you can't make a new one to replace it.

Last updated October 11, 2026. Dates verified against Zendesk's own announcement October 11, 2026.

Smart Instinct is a helpdesk implementation and AI agent setup agency and a Zendesk Advanced Partner. Jay Biros has 16 years of experience in helpdesk and contact center implementation.

On October 27, 2026, Zendesk accounts can no longer create new Support API tokens, in Admin Center or through the API. That's from Zendesk's own announcement. Tokens that already exist keep working until April 30, 2027, as long as they don't sit unused for 30 days, and then Zendesk deactivates every remaining token for good. Zendesk's instruction is to move each integration to OAuth before then.

Nothing breaks on October 27. That's the problem. It's the day the spare key stops being available.

What exactly changes, and when?

Zendesk is removing API tokens in three phases:

• July 28, 2026 (already started): Any token unused for 30 days is deactivated, and a token that stays deactivated for 60 days is deleted permanently. Accounts created on or after July 28, 2026 can't create or use API tokens
• October 27, 2026: No account can create new API tokens, through the UI or the API. Existing active tokens keep working
• April 30, 2027: All remaining tokens are deactivated permanently. They can't be reactivated, and the API token pages are removed from Admin Center

The change covers Support API tokens, which Zendesk says are used with the Ticketing, Help Center and Voice APIs. API tokens for Messaging, Chat and other products aren't part of it. Zendesk also says there's no opt-out or extension beyond April 30, 2027.

Why does October 27 matter if nothing stops working that day?

Because it removes the fallback. Until October 27, if an integration breaks because its token was deactivated or deleted, someone can create a new token and paste it in. After October 27, that option is gone. A deactivated token can still be reactivated within 60 days, but once it's deleted, the only way back is OAuth.

Zendesk does email all admins on day 25 and day 29 before a token hits 30 days unused, so check who reads those.

What usually runs on an API token?

Zendesk's announcement lists the kinds of workflows that stop if they aren't migrated:

• Webhooks that update tickets or change data in your own Zendesk account
• Custom scripts for automation or data syncs
• Third-party integrations built by contractors or external developers
• Middleware workflows where agents never touch the Zendesk UI directly

For Marketplace apps, Zendesk's developer policy already says third-party apps shouldn't use a customer's API credentials. Apps that move to OAuth keep working. For a custom app a third party built for you, Zendesk's advice is to ask that developer to migrate it to OAuth.

Zendesk also warns that automated processes may fail silently when a token stops working. Silently is the word to underline.

How do you find what still uses a token?

Zendesk gives you the tools. They just take a few passes to be useful.

1. Open the token list. In Admin Center, go to Apps and integrations, then APIs, then API tokens. For each token, note the "Last used" date, the "Deactivates on" date and the description, if anyone wrote one.
2. Run the usage report. On the same page, generate the usage report. It shows the previous 7 days of API requests made with API tokens, or up to 500MB of data, including the timestamp, a truncated token ID, IP address, user agent, endpoint and the user whose email was used with the token. Zendesk suggests generating it every few days to build a 30 to 60 day history, which catches the jobs that don't run weekly.
3. Match each token to a system and an owner. The IP address and user agent usually tell you which server or vendor is calling. Write it down: token, what uses it, who owns it, how it will be migrated.
4. Pick the migration path per integration. Most move to an OAuth client. Zendesk's developer docs cover both flows: authorization code for most integrations, and client credentials for server-to-server jobs where no user is around to approve access. Zendesk recommends a separate OAuth client per integration rather than one shared client.
5. Migrate one integration at a time. OAuth and API tokens both work until April 30, 2027, so there's no need to switch everything in one weekend.

Two details from Zendesk's developer docs that save a bad afternoon. Actions taken with a client credentials token are attributed to the Zendesk user who created the OAuth client, which affects audit logs, ticket ownership, automation-created comment authorship and permission checks, so Zendesk suggests a dedicated service account if attribution matters. And if you don't set a scope, the token defaults to full read and write access, so ask for the narrowest scope the integration needs.

If you'd rather work through the inventory with someone who has opened a lot of Admin Centers, the Smart Instinct audit reviews integrations as part of a full configuration review: smartinstinct.com/audit

What about webhooks that call back into Zendesk?

Webhooks that use an API token to call back into your own Zendesk instance stop working when tokens are removed. Zendesk says migrating those to action flows may be simpler than OAuth for many cases. Zendesk actions inside an action flow don't need an API token or OAuth, and they don't count toward your API rate limits. Custom actions still need their own authentication.

Action flows are available on Suite Growth, Professional, Enterprise and Enterprise Plus, and on Support Team, Professional and Enterprise, according to Zendesk. Each account gets an allowance of action credits based on its plan, so check yours before moving a busy webhook.

Zendesk has also said it will add native OAuth support for webhooks before the April 2027 deadline. It hasn't published a date for that yet, so we won't guess one.

Who this affects, and who it does not

This is for you if:

• Your Zendesk account has integrations, scripts, middleware or webhooks that use a Support API token, whether to call Zendesk's APIs or to update tickets and other data in your own Zendesk.
• Something was built by a contractor or a former teammate, and nobody is sure how it authenticates.

This is not for you if:

• Your account was created on or after July 28, 2026 (it couldn't create API tokens in the first place), or every integration you run already authenticates with OAuth.
• The tokens in question are for Messaging or Chat. Zendesk says those aren't part of this change.

FAQ

What happens to Zendesk API tokens on October 27, 2026?

Zendesk accounts can no longer create new API tokens, through the UI or the API. Existing active tokens keep working until April 30, 2027, unless they're deactivated for inactivity.

Do existing Zendesk API tokens stop working on October 27?

No. Existing active tokens keep working until April 30, 2027. A token that goes 30 days unused is deactivated automatically, and a token that stays deactivated for 60 days is deleted.

When do all Zendesk API tokens stop working?

April 30, 2027. Zendesk deactivates all remaining tokens permanently, they can't be reactivated, and Zendesk says there is no opt-out or extension.

How do I see which Zendesk API tokens are still in use?

In Admin Center, go to Apps and integrations, APIs, API tokens. Check each token's "Last used" date, and generate the usage report, which shows the previous 7 days of requests made with API tokens.

Can I reactivate a deactivated Zendesk API token?

Yes, within 60 days of when it was deactivated. After that it's deleted permanently. After April 30, 2027, no token can be reactivated.

What replaces Zendesk API tokens?

OAuth access tokens. For webhooks that call back into your own Zendesk, Zendesk says action flows may be a simpler path.

Are Zendesk Messaging and Chat API tokens affected?

No. Zendesk says only Support API tokens are affected.

Verified against

Checked October 8, 2026:

• Zendesk, "Announcing the removal of API tokens as an authentication method for API requests"
• Zendesk Developer Docs, "Migrating from API tokens to OAuth access tokens"
• Zendesk, "Understanding the action builder and action flows"

Want a second pair of eyes on your token list? The audit covers integrations along with the rest of your configuration: smartinstinct.com/audit