Zendesk for Developers: OAuth, Rate Limits, Webhooks, Apps

The short answer: build on OAuth, size for the rate limit

Zendesk is a workable platform for developers, but the ground is moving under it. Every remaining Support API token stops working permanently on 30 April 2027, and no account has been able to create a new one since 27 October 2026.^[1] Anything you build now should use OAuth. The second number that shapes your design is the rate limit: 200 requests a minute on Support Team and Suite Team, 400 on Suite Professional and 700 on Suite Enterprise. Around that sits a broad kit of webhooks, Zendesk Integration Services (ZIS), in-product apps, custom objects, messaging SDKs and free developer instances. Your plan decides which parts you get.

Zendesk's pricing page lists Support Team at $19 per agent per month billed annually or $25 billed monthly, and Suite Professional at $115 billed annually or $149 billed monthly. Billing is per agent, and every agent seat is paid, including the owner and suspended agents; our Zendesk pricing guide works through the full math. For developers this matters in one spot. Some integrations need their own user: the Jira integration, for example, uses a dedicated integration user who takes a paid seat. On Suite Professional that seat comes to $1,380 a year billed annually, by our arithmetic, or $1,788 over 12 months billed monthly.

OAuth only: the token deadline and what it breaks

The removal runs in phases. Accounts created on or after 28 July 2026 cannot create or use API tokens at all. On older accounts, tokens left unused for 30 days deactivate automatically and are deleted after 60. Since 27 October 2026 no account can create new tokens, and on 30 April 2027 the rest stop, with no opt-out. The change covers Support API tokens only, meaning Ticketing, Help Center and Voice. Password access for team members already ended after 31 December 2025. The deadline is fixed. Plan the migration now.

The replacement is an OAuth client created in Admin Center, using either the client credentials grant or the authorization code grant. Client-side CORS requests work only with OAuth access tokens. If you build an app for many Zendesk customers, it must use global OAuth tokens: the Developer Terms prohibit sharing API credentials with third parties, and Zendesk's developer policies bar any third-party app from authenticating with a customer's API token or with the customer's own OAuth client. That rule holds whether or not the app is listed on the Marketplace.

Two side effects catch teams out. Webhooks that call back into your own Zendesk with an API token stop working too; Zendesk promises native OAuth for webhooks but gives no date. Incremental APIs are also closing to third-party apps, with a rollout from 2 December 2026 and a target of 19 January 2027. Internal integrations keep them, and partners can ask for a 60-day extension. On the admin side, Enterprise custom roles gained a Manage APIs permission, and Action Builder custom actions now get their Zendesk OAuth connection created automatically.

Rate limits per plan, and the sub-limits that bite first

The plan limit is only the outer fence. Exceeding any limit returns HTTP 429 with a Retry-After header, and X-Rate-Limit headers report the current limit and the requests remaining.^[2] Read them on every response. Several endpoints carry their own ceilings: one user can update a single ticket 30 times in 10 minutes, Incremental Exports allow 10 requests a minute, and view execution allows 5 a minute per view per agent. Requests from Zendesk apps face an extra client-level cap of 100 a minute for each agent in each app. Ticket updates made in the agent interface do not count toward the general limit.

Pagination is the other trap. Offset pagination stops at 100 pages or 10,000 records, after which the API returns a 400 error. Cursor pagination has no depth limit and takes a page size parameter capped at 100 on most endpoints. Use cursors from day one. If you outgrow 400 or 700 a minute, the High Volume API add-on raises the Support and Help Center APIs to 2,500. Its gate names Suite Growth and above (or Support Professional and above) plus at least 10 agent seats. It is not copied to sandboxes, and Zendesk does not publish its price.

Suite Growth is no longer on the pricing page, so for a new buyer the cheapest qualifying route is Suite Professional. Ten seats there cost $13,800 a year billed annually, by our arithmetic, before the add-on itself. For most integrations, batching, caching and backing off beat buying capacity. Our Zendesk API guide covers the endpoints in detail.

Webhooks, ZIS and MCP: event-driven integrations

A webhook connects either to Zendesk events, such as user, organization, help center and community activity, or to a trigger or automation for ticket activity. It cannot do both, and you cannot switch later. Authentication can be an API key, basic auth or a bearer token, and a signing secret lets your endpoint verify each request. HTTPS endpoints accept up to five custom headers. The activity log keeps each invocation's status for seven days, and trial accounts are capped at 10 webhooks and 60 invocations a minute.

Delivery is best effort. Zendesk cannot guarantee single delivery, so duplicates happen.^[3] Write idempotent handlers. Requests time out after 12 seconds, and timed-out calls are retried up to five times; a 409 is retried up to three times, while a 429 or 503 is retried only with a Retry-After under 60 seconds. A circuit breaker trips at more than 1,000 errors, or 70% errors, in five minutes once a webhook sends at least 100 requests. It then pauses five seconds at a time until a request succeeds. Answer fast and queue the work.

ZIS runs workflows triggered by activity in Zendesk or another system, and those workflows can call APIs. It authenticates with OAuth 2.0 and allows 2,000 requests a minute on inbound webhooks and 6,000 on the Links API. Its gate also names Suite Growth and above or Support Professional and above, so among today's listed plans you need Suite Professional or Suite Enterprise. Support Team and Suite Team accounts should look at webhooks plus their own middleware instead.

Zendesk's built-in MCP client, generally available since 10 August 2026, connects Zendesk to outside MCP servers such as GitHub or Stripe and exposes their tools to action flows and AI agents. Zendesk's announcement lists Support Team and above and Suite Growth and above; Suite Team is not on that list. Reaching into Zendesk from an AI assistant is a different job, covered in the FAQ below.

Apps, custom objects and the Marketplace

Apps built on the Zendesk Apps Framework (ZAF) run in an iframe inside Support, Chat and Sell. You can keep them private or submit them to the Marketplace as free or paid public apps. Our count of the Marketplace API on 2 November 2026 found 1,823 published listings, 506 of them paid and 55 built by Zendesk. That is the shelf your app joins. Two limits apply. ZAF apps do not act on AI agent tickets until a human takes over, and Zendesk Sell, a separate CRM, retires on 31 August 2027, so a new Sell app has a short runway.

App Builder, on Suite Professional, creates custom apps from plain-language prompts and includes five app conversations. Its apps can reach Support, the help center, internal APIs and services such as Google, Jira or Slack, usually authenticating with an API key or OAuth 2.0. It suits a quick internal sidebar tool for technical and non-technical staff alike. For a product you ship to many accounts, write ZAF code instead, since public apps need the global OAuth setup described above. Action Builder covers no-code automation, with action flows of up to 60 steps.

Custom objects store your own data types next to tickets. The Custom Objects API is available on Suite Team and above, and on Support Enterprise for existing customers; Support Team accounts cannot use it. Each object holds up to 100 fields. Each record is at most 32 KB and counts toward storage, and an account cannot pass 50 million records. Only admins create objects, while light agents and contributors get view-only access to records. Suite Professional and above also get an AI-powered object builder in Admin Copilot, generally available since August 2026, where admins describe an object in plain language and refine its fields. For the ready-made connectors, see our Zendesk integrations guide.

Messaging SDKs, developer accounts and sandboxes

Messaging SDKs and Sunshine Conversations

Zendesk ships messaging SDKs for the Web Widget, Android, iOS and Unity, and all four support JWT user authentication. They are not equal. A custom launcher works only on the Web Widget, push notifications only on Android and iOS, and Unity lacks rich text and IP banning. Skill-based routing is not supported on the Web Widget or any SDK. Minimums are rising: the next major iOS SDK release requires iOS 16, and Android moves to API 24. Apps that keep a lower iOS target stay on the last version supporting iOS 14, without new features or fixes.

Activating messaging does not change SDKs you already deployed; the new messaging SDKs are separate and must be configured and shipped on their own. Custom bots and third-party chatbots plug in through the Sunshine Conversations APIs, the layer under the Web Widget and channels such as WhatsApp, Instagram and Telegram. Suite Professional includes a low-volume tier of 1,000 monthly active users and 1,000 notifications a month. Zendesk's pricing page lists Sunshine Conversations capacity beyond that at $50 per extra pack of 2,500 monthly active users and $50 per extra 25,000 notifications. Code that identifies WhatsApp users by phone number must follow Zendesk's migration guide for business-scoped user IDs.

Developer accounts and sandboxes

You do not need a paid plan to start. Zendesk offers a free 14-day trial developer account. Developer partners can get a sponsored instance for up to 5 agents, on Suite Enterprise by default for Marketplace partners, and it does not expire after 14 days.^[4] It is meant for developing, demoing and troubleshooting an app or integration. Zendesk suspends any sponsored Support account used to provide actual support, so never route real customers through it.

On customer accounts, sandboxes carry the testing. Suite Enterprise includes two, and Suite Professional can buy them as an add-on with no published price. A sandbox matches production only when created; a later sync updates products, add-ons and seat counts but no other data. Closed tickets in a sandbox archive after three days, and testing AI agents there consumes no automated resolutions. Suite Professional accounts without a sandbox test Admin Copilot changes against a production snapshot and reverse them by hand through the audit log. That is workable, but slower.

The bottom line

Zendesk gives developers a full kit: REST APIs with clear 429 handling, webhooks, ZIS, ZAF apps, custom objects, four messaging SDKs and a sponsored partner instance that does not expire after 14 days. The work is in the details. Build on OAuth now, because tokens end on 30 April 2027. Design for 200 requests a minute on the Team plans, use cursor pagination, and treat webhook delivery as best effort: handle duplicates and do not assume every event arrives. Support Team covers simple email-ticket syncs. Suite Professional is the first plan on today's pricing page with ZIS, App Builder and a path to the High Volume API.