Zendesk Support

Works with: Zendesk Support (cloud). What SafeHanded does in Zendesk: private (internal) comments on every step · a customer-visible reply for link delivery · the chain-of-custody certificate attached on purge · close-to-purge · request from a ticket (deep link).

Before you start

A Zendesk admin, and a SafeHanded Owner/Admin on the Team plan or above.
About five minutes.

1. Connect

SafeHanded connects with an OAuth client (client-credentials grant), not an API token — Zendesk is retiring API-token authentication (no new tokens from 27 October 2026; all deactivated 30 April 2027).

In Zendesk: Admin Center → Apps and integrations → APIs → Zendesk API → OAuth Clients → add an OAuth client. Set the type to Confidential. Copy the Unique Identifier (the client ID) and the Secret (shown only once). (Zendesk OAuth)
In SafeHanded: Settings → Integrations → Connect → Zendesk Support. Enter your subdomain (the part before .zendesk.com), the OAuth client ID and the secret, then click Connect and test.

Actions in Zendesk are attributed to the admin who created the OAuth client — use a dedicated service admin if you want a distinct audit trail.

2. Close detection

Nothing to set up. SafeHanded polls Zendesk for status changes, so resolving or closing a ticket purges its credential on the next poll. SafeHanded re-reads the ticket via the API before anything is purged — see how ticketing works.

3. Request from a ticket (deep link)

Zendesk has no built-in button that opens a web address, so the quickest way is a macro that adds the link to the ticket as an internal note.

In Zendesk, go to Admin Center → Workspaces → Agent tools → Macros and click Add macro. Name it, for example, Create SafeHanded request.
Add the action Comment/description, switch it to an internal note, and paste the link below into it. {{ticket.id}} is Zendesk’s placeholder for the ticket’s ID; Zendesk fills it in when the macro is applied.
Save the macro.
On a ticket, the agent applies the macro, submits the internal note, and clicks the link in it. The customer never sees an internal note.

https://safehanded.com/app/requests/new?ticket={{ticket.id}}

Settings → Integrations → your Zendesk card → Activity shows this link ready to copy.

Prefer a real button in the ticket sidebar? Install the Smart Links app from the Zendesk Marketplace and add a link with the same address (use Insert Variable for {{ticket.id}}).

Choosing a preset (optional). A preset is a saved request — the reason, how long the credential is kept, who receives it and how the link is sent. To start from one, add &preset= and the preset’s slug to the end of the link, for example &preset=password-reset. Each preset’s slug is shown, with a copy button, under Settings → Request presets. With no preset in the link, SafeHanded uses the client’s default preset, then the organisation default (Settings → Policy → Default preset for new requests), and otherwise the policy defaults.

No click at all. Point a Zendesk trigger’s Notify webhook action (for example on a safehanded tag) at a generic webhook integration’s trigger URL (Settings → Integrations → Generic webhook) with the SafeHanded trigger body; SafeHanded then creates the request with no one present. This needs a second ticketing integration (the generic webhook), which the MSP plan allows; the Team plan includes one ticketing integration. A request created this way is linked through the generic webhook integration, so its close-to-purge follows that integration’s setup, not Zendesk’s polling.

4. Status mapping

Zendesk statuses map by default — new / open → open, pending / hold → pending, solved → resolved, closed → closed. Custom statuses show as unknown (never purge) until mapped. With the default resolved or closed policy, a ticket marked solved purges on the next poll — set close-to-purge to when closed on the Policy page if you’d rather hold the credential until hard-close.

5. What technicians see

Internal comments (public: false): created · submitted · (optionally) revealed · destroyed · expired · revoked · rotation recommended.
Public reply (if the preset delivers in-ticket): the secure link and a one-line explanation — never the challenge code.
The certificate PDF attached on destruction (if the Attach certificate policy is on).

Troubleshooting

Symptom	Cause / fix
Test connection fails	Check the OAuth client is Confidential and the client ID (Unique Identifier) and secret are correct; a wrong secret returns 401. If it authenticates but reads fail, widen the client’s scopes.
“Unknown status” on the card	Map the status in the status-map editor.