Okta introduces a stronger, more resilient way to manage Zendesk lifecycle provisioning by natively supporting OAuth 2.0 with automatic token refresh. 

Administrators must migrate existing Zendesk provisioning integrations to use OAuth 2.0 in the Okta Admin Console to prevent service disruption when Zendesk deprecates API tokens. Zendesk transmits API tokens using HTTP Basic authentication, which lacks Multi-Factor Authentication (MFA) protection, specific permission scoping, and built-in rotation or expiration. A single API token allows impersonation of any user in the Zendesk account, including administrators. Moving to OAuth 2.0 eliminates the need for Okta to store a long-lived, unscoped credential.

NOTE: This article applies only to customers who use the Okta Zendesk integration for User Provisioning, in which the connection is authenticated using a Zendesk API token or an admin username and password. 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Zendesk Provisioning

The Zendesk API token deprecation timeline

Review the following timeline for the Zendesk API token deprecation and the Okta OAuth 2.0 migration

What are the prerequisites for this migration?

Ensure the following requirements are met before migrating the Zendesk provisioning integration to OAuth 2.0.

• An active Zendesk app integration in Okta that uses an API token or administrator username and password for User Provisioning.

• An App Administrator or Super Administrator role in Okta to modify the application provisioning settings.

• A Zendesk Administrator credential to approve the OAuth consent screen for the Zendesk account.

The Zendesk provisioning integration requires migration to OAuth 2.0.

Navigate to the Zendesk application in the Okta Admin Console, edit the provisioning integration settings, and authenticate with Zendesk using an administrator credential to grant Okta the required permissions.

1. In the Okta Admin Console, go to Applications, and then select Applications.

2. Select the Zendesk application.

3. Select the Provisioning tab, and then choose Integration from the Settings menu.

4. Select Edit.

5. Confirm that the Subdomain field contains the correct Zendesk subdomain.

6. Select Authenticate with Zendesk or Re-authenticate with Zendesk.

7. Enter the Zendesk Administrator credentials on the Zendesk login page, review the consent screen, and select Allow.

8. Return to the Okta Admin Console and select Save.

NOTE: Administrators enter Zendesk credentials directly on the Zendesk login page. Okta never sees or stores these credentials. After the administrator grants consent, Okta receives an access token and a refresh token and automatically renews the access token. This step requires no repetition unless the grant is revoked in Zendesk.

How is the provisioning connection verified?

Confirm the integration reports a successful connection on the Provisioning page, trigger a test provisioning event, and review the System Log for errors.

1. On the Provisioning page, select Integration and confirm that the integration reports a successful connection and that no re-authentication banner displays.

2. Trigger a provisioning event to confirm end-to-end operation.

3. Navigate to Reports, select System Log, and review the logs for any provisioning errors relating to the Zendesk application.

The legacy API token requires removal in Zendesk.

Access the Zendesk Admin Center, locate the API token previously used for the Okta provisioning integration, and delete it to remove the redundant credential.

1. In Zendesk, go to Admin Center, select Apps and integrations, choose APIs, and then select API tokens.

2. Identify the token previously used for the Okta provisioning integration.

3. Delete the token.

NOTE: Security Assertion Markup Language (SAML) and OpenID Connect (OIDC) Single Sign-On from Okta to Zendesk use different protocols and continue to work without any change.

Related References

• How to configure Zendesk
• Zendesk deprecates API tokens