> ## Content Index > Fetch the complete content index at: https://internalnote.com/llms.txt > Use this file to discover other available public pages before exploring further. # Expanded API Support via Custom Authentication for Zendesk Webhooks - URL: https://internalnote.com/custom-authentication-for-webhooks-update/ - Published: 2023-04-04T06:45:55.000Z - Updated: 2025-09-08T06:43:08.000Z - Description: Zendesk announced Custom Headers and API Key support for its Webhooks. And fixed my previous list of shortcomings a 100% - Author: Thomas Verschoren - Tags: Platform Zendesk announced Custom Headers and API Key support for its Webhooks. Where they already supported `Username/Password`, you can now add up to 5 custom headers to your webhook configuration, expanding its support to way more platforms. [Announcing API key authentication and custom headers for webhooksAnnounced on Rollout starts March 30, 2023 March 30, 2023 Zendesk is excited to announce that you can now use API key authentication and define additional headers when configuring webhooks.…![](https://theme.zdassets.com/theme_assets/10557657/4b4b2fe0860351e0e1e6bcf9060550f5c7f163ea.ico)Zendesk helpZach Anthony![](https://theme.zdassets.com/theme_assets/10557657/3cc7e6328cd4f823ed1332d774490412f0531606.svg)](https://support.zendesk.com/hc/en-us/articles/5532092885658-Announcing-API-key-authentication-and-custom-headers-for-webhooks?ref=internalnote.com) I wrote about [Shortcomings of Webhooks](https://internalnote.com/shortcomings-of-zendesk-webhooks/) last fall, and mentioned three scenarios that weren't possible with webhooks at that time: 1. Use webhooks to send data to Zendesk Sell, due to lack of `Accept: application/json` header 2. Access resources behind Cloudflare Zero Trust, due to lack of custom authentication headers 3. Accessing the Asana API, due to lack of `bearer: token` support. Let's see how this new release changes things. # Add Sell Lead from Zendesk Support My first example was a scenario where I wanted to create a lead in Sell each time a ticket was assigned to Sales. You can use it to add leads for tickets you assign to the Sales group, or create tasks in Sell for your Sales team,.. There obviously is a very nice integration for Sell and Support already, but sometimes doing things automatically via triggers is just a bit easier. ## Step 1: Creating a Webhook Step one in our flow is creating a new webhook. Use `https://api.getbase.com/v2/leads` as the Endpoint URL, `POST` as the method, and `JSON` as the format. Next choose `Bearer token` as the authorisation method and enter your [Access Token](https://developer.zendesk.com/documentation/sales-crm/first-call/?ref=internalnote.com#1-generate-an-access-token). Finally, add a **new** Header with `Accept` as the name, and `application/json` as the value. ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-16.57.16.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-16.58.24.png) ## Step 2: Adding a Trigger Next up, calling our Webhook. For this we'll use a trigger which, each time a ticket is assigned to Sales, will create a new Lead in Sell with the relevant information, and solve the ticket. The ticket will dissappear from the Inbox of your Support Team, and a new Lead will appear in Sales' Pipeline. Create a new trigger that looks for: - group is changed to Sales And add the following conditions: - Status is solved - Notify Webhook (the one you just created) and add the following JSON payload. ```json { "data": { "first_name": "{{ticket.requester.first_name}}", "last_name": "{{ticket.requester.last_name}}", "organization_name": "{{ticket.organization.name}}", "description": "{{ticket.description}}", "email": "{{ticket.requester.email}}" } } ``` ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-17.00.32.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-17.02.05.png) ## Result And, if all goes well, each time we now assign a ticket to sales, the ticket will be resolved, and a new lead will show up in Zendesk Sell. ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-17.04.29.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-17.04.54.png) # Protect Cloudflare Worker As you've probably already noticed on this blog, I'm a big fan of using Cloudflare Workers to handle complex API actions outside of Zendesk. For example, in the flow below, I use a Worker combined with Zendesk Webhooks to update a newly user with a proper signature, alias and profile picture. [Webhooks for User and Organisation eventsZendesk recently launched an expansion on their webhooks functionality that allows you to subscribe to changes in Users and Organizations and act upon those actions. In this article we’ll show how you can auto-complete agent profiles with a signature, alias and profile image upon creation.![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/size/w256h256/format/png/2023/01/internalnote_green-copy.svg)Internal NoteThomas Verschoren![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/02/Apple-TV-4K-Copy-5@0.5x-3.jpg)](https://internalnote.com/zendesk-user-events/) Up till now, these workers had to run "unprotected" since Zendesk was not compatible with the way Cloudflare Access works. Now, with this release, I can finally protect these workers by adding these two custom headers to my webhooks. ```html CF-Access-Client-Id: CF-Access-Client-Secret: ``` ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.20.56-1.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.25.15.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.25.47.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.22.09-2.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.22.25-2.png) For more information on creating Access Tokens for Workers, take a look at the article below. [Service tokens · Cloudflare Zero Trust docsYou can provide automated systems with service tokens to authenticate against your Zero Trust policies. Cloudflare Access will generate service tokens …![](https://developers.cloudflare.com/assets/icon-192x192-7f0daf28.png)Service tokens · Cloudflare Zero Trust docs![](https://developers.cloudflare.com/zt-preview.png)](https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/?ref=internalnote.com) # Adding a task to Asana So far, that's two out of three issues resolved. Let's check the final one, Asana. In this example we're going to create a new task in Asana whenever a ticket is updated and the ticket type is changed to, you guessed it, Task. ## Step 1: Create a Webhook First off we create a new webhook that calls the `ttps://app.asana.com/api/1.0/tasks` endpoint. We use type `JSON` and action `POST` as the option and select `Bearer Token` as our authentication type. See [this article](https://developers.asana.com/docs/personal-access-token?ref=internalnote.com) on how to get a token. To complete the setup, add a custom header with name: `accept` and value: `application/json` and save your webhook. ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.45.20-1.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.46.09-1.png) ## Step 2: Create a trigger Trigger Create a new trigger that runs when a : - Ticket is updated - Type is changed to Task - Tags does not contain `asana` (this prevents multiple tickets being created) Set the actions to: - Alert Webhook (the one you just created) - Add tag `asana` In the Alert Webhook action, add the following JSON payload. Don't forget to replace the [project](https://developers.asana.com/reference/goal-relationships?ref=internalnote.com) and [workspace](https://developers.asana.com/reference/workspaces?ref=internalnote.com#workspace) IDs with your own. The result will be an Asana task with the latest comment as the description and the ticket subject as the title. ```json { "data": { "resource_type": "task", "name": "{{ticket.title}}", "html_notes": "Zendesk Ticket #{{ticket.id}}: {{ticket.latest_comment}}", "projects": [ "1204303360323625" ], "workspace": "1201829988571356" } } ``` ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.47.03-1.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-21.01.59-1.png) ## Result And if all goes well, each time we now change a ticket to type 'Task" a new task in Asana is created! Naturally the native [Asana for Zendesk](https://asana.com/apps/zendesk?ref=internalnote.com) integration is way more useful, but this example shows that the Webhook authentication updates allow for a lot more API integrations now! ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.55.57-1.png) ![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Screenshot-2023-03-30-at-20.59.53-1.png) # Conclusion 3 out of 3\. I think one of my [wishes](https://internalnote.com/zendesk-wishlist/) came true. A seemingly small update to the Webhooks feature, makes three otherwise impossible scenarios now possible. What kind of webhooks will you build next? 🥳 Thanks for reading this article and the blog. If you liked this content, please consider ****subscribing** via email or ****share** the article to your colleagues.