Zendesk
Difficulty: ReviewedYou can create a local OAuth client and connect your own Zendesk instance in under an hour, but that client only works on one subdomain. To let other Zendesk customers connect, Zendesk has to approve a global OAuth client, and since August 2025 your integration must also go through Marketplace review (1 to 3 weeks for new submissions), even if it won't be listed publicly.
- Your work
- 4–10 h
- Waiting on Zendesk
- Unknown
- First user connects
- Today, in about 30 minutes, on your own Zendesk subdomain using a local OAuth client
Plan
17 tasksSetupBefore you start
BuildYour instance
work 20–45 min · wait noneOnly users on the single Zendesk subdomain where you created the local OAuth client
LaunchAny Zendesk customer
work 4–10 h · wait unknownAdmins and users on any Zendesk subdomain
Why reviewed
- Tier
- Third-party integrations must use a Zendesk-approved global OAuth client and pass Marketplace review. Local clients only work on one instance, and you're not allowed to use a customer's own OAuth client or API token.
- Using Composio?
- Composio lists a managed Zendesk OAuth app, so you can prototype without registering your own client. To ship under your own name and meet Zendesk's Marketplace rules (approved global client plus marketplace headers), register your own global client before launch.ZENDESK
Scopes
3
Zendesk doesn't classify scopes as sensitive or restricted. For a global client, Zendesk may cap the allowed scopes when it approves your request. Requesting a scope outside that list fails with invalid_scope.
read / writebasicRead or write access to all resources. Zendesk reviews these as part of the global OAuth request, which asks for the minimum scopes your app needsresource:read / resource:write (for example tickets:read)basicAccess to a single resource type. Nothing extra. These are preferred for a narrow requestimpersonatesensitiveLets admins act on behalf of end users. No separate process is documented. It's listed in the global request like any other scope (inferred)
When you get stuck
5
Global OAuth request is rejected or not accepted
The request was submitted from a subdomain without the d3v- prefix, or the local client's identifier lacks zdg- or has empty optional fields
FixGet a sponsored d3v- account, recreate the local client with a zdg- identifier and every field filled in, then resubmit
OAuth fails for customers on other subdomains
Local OAuth clients only exist on the instance where they were created
FixUse an approved global OAuth client. Don't ask customers to create their own clients or API tokens, which Zendesk prohibits for third parties
400 Bad Request with invalid_scope
Your app requested a scope outside the allowed scopes Zendesk set on the global client
FixRequest only allowed scopes, or contact Zendesk Support about "global oauth allowed scopes" with your client_id
Docs1401 invalid_token after about 30 minutes
Access tokens expire by default: refresh tokens are required for global clients since February 2, 2026, and default expiry applies to local clients created after April 30, 2026
FixImplement the refresh_token grant and store the rotated tokens each time
Marketplace submission stalls
Zendesk doesn't see the X-Zendesk-Marketplace-* headers on the designated test account
FixAdd all three headers once the app ID is assigned and make API calls against the test account
Docs11
Not confirmed
4
How long does global OAuth client approval take?
Zendesk's docs and third-party guides give no timeframe, and no community reports turned up
ResolveWatch the ticket Zendesk sends after you submit, or ask in Zendesk's developer community
How long does sponsored account conversion take?
The docs only say Zendesk will notify you
ResolveSubmit the form early, while your trial still has time left
Must the global OAuth request be approved before you submit the Marketplace app, or can they run in parallel?
The docs describe both steps but don't say which order is required
ResolveAsk Marketplace Operations in the global OAuth ticket
What exactly is required for an unlisted (private distribution) integration?
The developer update says unlisted integrations must submit, but no page details how unlisted listings work
ResolveCheck the Marketplace portal submission options or ask Zendesk partner support
Sources
14
- 1Set up a global OAuth clientZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 2Composio managed auth toolkitsComposio docs · Composio docs · checked 27 Oct 2026
- 3Getting a trial or sponsored account for developmentZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 4Creating and using OAuth tokens with the APIZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 5Using OAuth authentication with your applicationZendesk Help Center · Official docs · checked 27 Oct 2026
- 6How to register your own Zendesk API OAuth appNango docs · Community · checked 27 Oct 2026
- 7Developer update: Enhanced security guidelines for third-party apps, integrations, and botsZendesk Help Center · Official docs · checked 27 Oct 2026
- 8Announcing the required expiration of global OAuth access and refresh tokensZendesk Help Center · Official docs · checked 27 Oct 2026
- 9Submit your appZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 10Managing global OAuth clients and app associationsZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 11Request header requirements for Marketplace appsZendesk Developer Docs · Official docs · checked 27 Oct 2026
- 12Announcing enhanced security guidelines for third-party apps, integrations, and botsZendesk Help Center · Search results · checked 27 Oct 2026
- 13Critical Zendesk update: API tokens being replaced with OAuthCrayon · Search results · not yet checked
- 14What is the Zendesk Marketplace?Zendesk Developer Docs · Search results · not yet checked
Feedback
On the version researched 27 Oct 2026- worked
- 0
- waiting on review
- 0
- stuck
- 0
- wrong
- 0