Contributor

Solved

Removal of API tokens - how do I use OAuth for Postman and Power Automate

Forum|Forum|2 months ago
June 16, 2026
9 replies
242 views

I am Admin for our ZD instance, and I work on the business side, not IT. Back in a former life, I was a software engineer, but not anymore. So I use Power Automate when I need to do code-like things. I have a number of Power Automate flows that invoke the ZD API (via the HTTP action) and teach myself the API via Postman. Auth for both Power Automate and Postman uses API keys.

API key auth is being eliminated for Support.

I have no idea how to transition to OAuth for my needs. There is not documentation that provides me any guidance. I have no experience with OAuth, and this looks like something I’ll need IT assistance to set up - but I have no idea what to even ask for. Can someone provide me some guidance?

Note that Exploring Zendesk APIs with Postman on the ZD developer website instructs to use API key auth for Postman.

Best answer by Ahmed Zaid

Hi @David Wexelblat,

Power Automate supports OAuth2 with Zendesk, although there is a bug with their implementation (they mistyped the scope, easily fixable by Microsoft if you report it).

However, I understand that you want to use direct http request because this connector is not only bugged, but very limited in the available actions. Sadly, Power automate does not seem to support http authentication with custom OAuth 2 out of the box.

Here are your options:

Use Zendesk’s action flows instead. OAuth is natively supported (recommended).
Use a modern automation platform instead like n8n/Zapier.
Generate OAuth access token for every flow run using client credentials grant.

For option 2, the flow will look like this for a simple 1 request manual flow:

You would need to create your own OAuth client, choose an identifier, set kind to Confidential, and save the secret. You do not need a redirect URI.

The first request, Token generation, looks like this:

If you have access to Azure vault, it is highly recommended to fetch the secret from there instead of hard coding it in the request. This hard coding is simple but not secure best practice.

The second node simply extracts the the token from the response body of the first request. It looks something like this:

The third node is your actual request to Zendesk. You can authenticate it as follows:

I will try to cover postman in another comment.

Greg K

Employee

Hi David! I don’t have experience with Power Automate, but I did some research into the topic. From what I gather, custom connectors are the method that you use to make the API calls...with the caveat that I don’t know this area, so this may be wrong! At that point, there is information on how to utilize OAuth in that article, so you would want to follow our tutorial on setting up OAuth in combination with the PA article.

I hope that gets you in the right direction or at least someone with more knowledge on this side can chime in. If you have any questions for me about the Zendesk OAuth side of things, let me know and I’ll be happy to help out!

D

David WexelblatAuthor

Contributor

@Greg K Custom connectors aren’t part of this equation - I’m simply performing HTTP requests (almost exclusively GET) via Power Automate - basically automating what I can do manually via Postman, using PA for scheduling and processing the output.

I had a discussion with Claude about how to do this and Claude is telling me that I can create an OAuth Confidential token for these purposes, because invoking the API from within Power Automate is more akin to a server app than a client app. Is that correct? If I have to use Public OAuth for this, I’m way out of my depth and likely need to involve my IT team.

Greg K

Employee

Hi David! As I mentioned, I am not at all familiar with Power Automate, so I don’t know how to answer that particular question. I’d recommend reaching out to someone familiar with that service to see how they can assist.

D

David WexelblatAuthor

Contributor

Well, that was the point of this thread...

Vancouver

Community Expert

I’m not currently facing any worries in regards to the removal of API tokens but David’s issue sounds legitimate so I’m bumping this thread.

Not sure what’s the purpose of Greg’s comments if he cannot help, Zendesk should update their documentation and provide assistance during this period.

Ahmed ZaidAnswer

User Group Leader

Hi @David Wexelblat,

Power Automate supports OAuth2 with Zendesk, although there is a bug with their implementation (they mistyped the scope, easily fixable by Microsoft if you report it).

However, I understand that you want to use direct http request because this connector is not only bugged, but very limited in the available actions. Sadly, Power automate does not seem to support http authentication with custom OAuth 2 out of the box.

Here are your options:

Use Zendesk’s action flows instead. OAuth is natively supported (recommended).
Use a modern automation platform instead like n8n/Zapier.
Generate OAuth access token for every flow run using client credentials grant.

For option 2, the flow will look like this for a simple 1 request manual flow:

You would need to create your own OAuth client, choose an identifier, set kind to Confidential, and save the secret. You do not need a redirect URI.

The first request, Token generation, looks like this:

If you have access to Azure vault, it is highly recommended to fetch the secret from there instead of hard coding it in the request. This hard coding is simple but not secure best practice.

The second node simply extracts the the token from the response body of the first request. It looks something like this:

The third node is your actual request to Zendesk. You can authenticate it as follows:

I will try to cover postman in another comment.

Ahmed Zaid (aidvisor.eu)

Ahmed Zaid

User Group Leader

For Postman,

Create a new client in Zendesk for Postman like you did for Power automate as mentioned in the previous comment.
Change the collection’s authentication settings to OAuth 2.0
Use the following settings to configure a new token
Click on Get new access token
In the dialogue box that appears, click proceed. Then on the next one, click on Use token
Your current token is now updated. Make sure you activate Auto-refresh

Note: If you ever change environment (e.g. production/sandbox), you will need to get a new token and set it on the collection level.

Ahmed Zaid (aidvisor.eu)

D

David WexelblatAuthor

Contributor

@Ahmed Zaid Thank you so much for this.

Unfortunately, action flows can’t currently do what I’m doing through Power Automate, and due to limitations on tool access (since, as I noted, I work on the business side, not IT/development), Power Automate is my only real option.

I understand what you’re describing here and will work on implementing a test flow with OAuth and once I’m comfortable that I haven’t messed it up, I’ll update my current flows. Thanks again.

D

David WexelblatAuthor

Contributor

@Ahmed Zaid After spending much of last month moving into a new house, I finally got a chance to work with this today. Thanks again for your detailed steps. Everything worked exactly as you described it. I first tested Postman, then made a dummy manually-triggered Power Automate flow. Now I’m updating my actual flows (cloning them, deactivating the original, and setting the OAuth versions active). They’re working fine manually triggered and I’ll find out overnight if they work as expected on schedule (I assume that they will).

Sign up

Login with SSO

Login to the community

Login with SSO