IntegrationsZendesk
The second destination whose address is per customer rather than per product. ServiceNow proved the shape; Zendesk shows it was a shape and not a special case.
Your AI, MCP server or API
Their workspace and approved access
Their entitled capabilities and version
Validation, health and the next action
Available today
Ready for customer deployments with customer-scoped authorization, validation and lifecycle management.
What a forward deployed engineer does by hand today.
An OAuth redirect to the customer's own host. The subdomain has to be known before the flow starts, so a wrong one fails before authorization rather than authorizing into another company's helpdesk.
The person whose calendar decides your go-live date.
A Zendesk administrator. An agent without admin rights can complete the same screen and produce a grant that cannot see other agents' tickets, so the instructions say so.
Whose identity the product acts as, and where that grant lives.
OAuth 2.0 per account, with the authorizing user's email and role recorded so it is visible who the deployment acts as.
The repeatable half, turned into software.
The per-subdomain OAuth flow, proving which account actually authorized rather than trusting the subdomain somebody typed, credential storage, renewal where the client issues refresh tokens, and revocation.
The half that is theirs and should stay theirs.
Their Zendesk account, and which agent authorized it.
How capabilities map onto what the platform will let you do.
Read is account-wide because Zendesk has no per-object read scope. Writes are per object type, so a deployment that only touches tickets never asks for users.
What has to execute before anyone is told it works.
A real read of the ticket list against the customer's own host.
Rotation, expiry, revocation, and who notices first.
Tokens do not expire unless the client opted into rotation. Renewal is attempted where a refresh token exists and the customer is told to reconnect, with the reason, where it does not.
What happens to this customer when you ship version four.
The subdomain is re-read live so a corrected value reaches deployments that already exist. The object list is not: it decides the scopes the customer approved, and moving those under an installed customer would make the freeze a decoration.
What actually goes wrong, named rather than generalised.
A grant made by a non-admin agent, which authorizes and then cannot see most of the helpdesk.
How you learn it broke without the customer telling you.
Token validity against the customer's host, and scope drift against the current package.
Ready for customer deployments with customer-scoped authorization, validation and lifecycle management.
Available for customer deployments, with customer-scoped authorization, validation and lifecycle management.
Connect a source, approve what ships and send your customer an install link. 2 customer environments free. No card required.
