Migrate Zendesk API token auth to OAuth before April 2027 deprecation

[lisajill]

Background

Zendesk is removing API token authentication for the Ticketing, Help Center, and Voice APIs. Reference: https://support.zendesk.com/hc/en-us/articles/10840968198042

I believe this may impact our contact form, so we will need to get ahead of it.

Timeline

Date	Phase	Impact
July 28, 2026	Phase 1	Tokens unused 30+ days auto-deactivate; new accounts can't create tokens
October 27, 2026	Phase 2	No new tokens can be created (UI or API)
April 30, 2027	Phase 3 — hard deadline	All remaining tokens permanently deactivated; no reactivation

Our tokens are actively used so Phase 1 won't immediately affect us. Phase 2 is the practical deadline — after October 27 we can't create replacement tokens if anything goes wrong during migration. Target: migrate before October 27, 2026.

WAT Impact

Thundermail contact form

Migration path

tbd

Notes

• A 60-day grace period after Phase 1/2 deactivations allows reactivation — but Phase 3 is permanent
• Messaging, Chat tokens are not affected — only Ticketing/Help Center/Voice APIs
• OAuth tokens have expiry and must be refreshed — adds token lifecycle management that doesn't exist today

[Sancus]

This stays fully automated with the client credentials flow, so shouldn't be a big deal.