> ## Content Index
> Fetch the complete content index at: https://internalnote.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Shortcomings of Zendesk Webhooks
- URL: https://internalnote.com/shortcomings-of-zendesk-webhooks/
- Published: 2022-09-21T22:00:00.000Z
- Updated: 2025-09-08T06:45:40.000Z
- Author: Thomas Verschoren
- Tags: Platform

🥳

****Update 2023-03-30**  
Zendesk fixed all issues mentioned in this article. See the [Announcement](https://support.zendesk.com/hc/en-us/articles/5532092885658-Announcing-API-key-authentication-and-custom-headers-for-webhooks?ref=internalnote.com) or read the article below.

[Expanded API Support via Custom Authentication for Zendesk WebhooksZendesk announced Custom Headers and API Key support for its Webhooks. And fixed my previous list of shortcomings a 100%![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/size/w256h256/format/png/2023/01/internalnote_green-copy.svg)Internal NoteThomas Verschoren![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/03/Apple-TV-4K-Copy-56@1x-1.jpg)](https://internalnote.com/custom-authentication-for-webhooks-update/)

For a long time Zendesk had the Targets feature to notify external API endpoints of changes within Zendesk. Last year, they moved those Targets over to more common HTTP Webhooks supporting `POST,GET,DELETE and PUT` together with a Basic Auth or Bearer Auth header.

However, more and more while developing integrations I run into limits of this feature.

Two examples

### **Zendesk Sell**

Zendesk Sell has an ancient looking [contact form](https://support.zendesk.com/hc/en-us/articles/4408832077338-Setting-up-and-publishing-the-lead-capture-form?ref=internalnote.com) for capturing leads. It works but it looks terrible and is completely separate from existing contact forms on Guide or the Zendesk widget.

So, for a while I’ve playing with the idea of

1. Creating a Sales form in Zendesk Guide
2. Adding a trigger that notifies a webhook when a ticket in the Sales form is created
3. Have the trigger call the Sell API and create a lead.

This way, all contact points are integrated within the Guide Forms, and we can leverage Answer Bot to deflect recurring questions.

Zendesk Sell has an [extensive API](https://developer.zendesk.com/api-reference/sales-crm/resources/leads/?ref=internalnote.com) to create leads that theoretically is compatible with the Webhooks feature.

```sh
curl -v -X POST https://api.getbase.com/v2/leads \ 
-H "Accept: application/json" \ 
-H "Content-Type: application/json" \ 
-H "Authorization: Bearer $ACCESS_TOKEN" \ 
-d '{ "data": { "first_name": "Mark", "last_name": "Johnson", "organization_name": "Design Services Company", ... } }'
```

However, note the `Content-Type: application/json` line. When trying to contact Sell via a Webhook the test mode gives the following error:

```json
"error": { 
	"code": "invalid_header", 
    "message": "invalid request header", 
    "details": "The header 'Accept' is malformed, missing, or has an invalid value."
}
```

So, without being able to add additional headers, this API is unusable. Luckily there’s a native Support to Sell integration on the marketplace, but it’s a prime example of Webhook limitations.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2023/01/Screenshot-2022-09-22-at-19.56.32.png)

### **Cloudflare Zero Trust**

Cloudflare is a big player when it comes to offering serverless functions and zero-trust security. This year they even released an [API gateway](https://blog.cloudflare.com/api-gateway/?ref=internalnote.com) that makes offering secure and responsive API endpoints a breeze.

However, connecting many companies leveraging Cloudflare to “expose” internal APIs to the world do so by using Cloudflare Zero Trust and [Service tokens](https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/?ref=internalnote.com).

And, you guessed it, Service tokens require adding two header lines when making a request:

```html
CF-Access-Client-Id: <Client ID> 
CF-Access-Client-Secret: <Client Secret>
```

### Which, currently, is not compatible with Zendesk Webhooks.

### **Asana**

And finally, one last one we ran into lately: [Asana](https://developers.asana.com/docs/create-a-task?ref=internalnote.com), where once again the requirement for two additional header items defining accepted content-types are impossible to submit, and thus impossible to use.

```curl
curl -X POST https://app.asana.com/api/1.0/tasks \ 
-H 'Content-Type: application/json' \ 
-H 'Accept: application/json' \ 
-H 'Authorization: Bearer {access-token}' \ 
-d '{"data": {"field":"value","field":"value"} }'
```

### **Workaround**

Mentioning issues is one thing. Fixing them is another.

Currently my workaround is the following:

1. I create a Cloudflare Worker as a proxy for each webhook I need in Zendesk
2. My Webhooks in Zendesk POST to the Worker
3. The Worker processes the request, appends a `header` and forwards the request to the real API
4. The API responds to the request call
5. The Worker relays the response to Zendesk

See [this Worker](https://developers.cloudflare.com/workers/examples/alter-headers/?ref=internalnote.com) as a generic example.

### **Zendesk Feature Request**

A more structural solution would be Zendesk adding support for custom headers in Webhooks.

If you like to see this too, please upvote [this](https://support.zendesk.com/hc/en-us/community/posts/4971033907994-Need-for-Custom-Headers-in-Webhooks?ref=internalnote.com) community post and add your feedback.

[See Community Post](https://support.zendesk.com/hc/en-us/community/posts/4971033907994-Need-for-Custom-Headers-in-Webhooks?ref=internalnote.com)