Set up OAuth 2.0 Client Credentials authentication for Zendesk

The Zendesk connector authenticates with OAuth 2.0 Client Credentials (2LO). You register an OAuth client in Zendesk, store the client ID and client secret in an AWS Secrets Manager secret, and the connector exchanges them for an access token. There is no per-user consent or redirect step. Complete all the following steps before you configure the data source in Amazon Bedrock.

Prerequisites

Before you begin, make sure that you have the following in Zendesk:

• A Zendesk Suite (Professional or Enterprise) account with admin access.

• Your Zendesk host URL (for example, https://yoursubdomain.zendesk.com). You provide this value as the connection hostUrl, and it must match the instanceUrl that you store in the secret.

Step 1: Create the OAuth client

1. Log in to your Zendesk account as an admin.

2. From the left navigation, go to Admin Center.

3. In Admin Center, choose Apps and integrations.

4. On the Apps and integrations page, choose OAuth Clients, and then choose Add OAuth client.

5. Complete the form:

   • Client name – A human-readable name that is visible to users.

   • Unique identifier – This value becomes the Client ID (clientId) that you store in the secret.

   • Client kind – Confidential. The connector authenticates with a client secret, and only a confidential client is issued one. A public client doesn't receive a secret.

   • Scopes – Grant read. The connector only reads content to crawl, and the token exchange requests scope=read.

   • Redirect URL – Not used by this connector, because the client credentials (2LO) flow performs no redirect. If the form requires a value, enter a placeholder such as http://localhost.

6. Choose Save.

7. When the secret dialog appears, copy the generated secret and store it securely. This is the Client Secret (clientSecret).

Important

The client secret is shown only once at creation and can't be regenerated or viewed again. If you lose it, recreate or rotate the OAuth client and update the AWS Secrets Manager secret.

You now have the three values that the connector needs: your host URL, the Client ID, and the Client Secret.

Step 2: Create the Secrets Manager secret

Store the credentials in an AWS Secrets Manager secret in the same AWS Region as your knowledge base with the following key-value pairs:

{
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret",
    "instanceUrl": "https://yoursubdomain.zendesk.com"
}

Secret fields

Field	Description
clientId	The OAuth client's Unique identifier from Zendesk (step 1).
clientSecret	The OAuth client's generated secret, copied at creation time in step 1.
instanceUrl	Your Zendesk host URL (include https://, no trailing slash). This value must match the connection hostUrl. The connector validates that the two are equal and builds the token endpoint from hostUrl.

Create the secret with the AWS Command Line Interface:

aws secretsmanager create-secret \
  --name bedrock-zendesk-creds \
  --secret-string file://secret.json

Record the secret ARN from the response. You use it as the data source secretArn. The knowledge base execution role must have secretsmanager:GetSecretValue permission on the secret.

Next steps

After you store the secret, create the data source. See Connect a Zendesk data source.