# How to connect Zendesk to Hermes Agent (no API keys)

> Connect Zendesk to Hermes Agent with ClawLink: 452 tools your agent can call from chat via hosted OAuth, no API key. Zendesk is ending API tokens on 2027-04-30, so hosted OAuth is the durable choice.

Web version: https://claw-link.dev/hermes/zendesk

Most guides for giving Hermes Agent Zendesk access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Zendesk setup: pair once in the browser and your always-on Hermes agent can act on Zendesk for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself.

**Start here — paste this into Hermes to set up ClawLink:**

> Set up ClawLink for Hermes and tell me when it's ready.
> 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable`
> 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait.
> 3. I'll approve it in my browser, then reply "approved".
> 4. When I say approved, finish setup: `hermes clawlink finish`
> 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready.

## Setup

It takes three steps to connect Hermes to Zendesk.

1. **Install ClawLink** — add the plugin to Hermes Agent once.
2. **Connect Zendesk** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask Hermes Agent in plain English.

**Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect zendesk  # connect Zendesk (browser OAuth)
npx -y @useclawlink/cli actions zendesk  # list available actions
npx -y @useclawlink/cli run zendesk <action> --input '<json>'  # execute (add --confirm for writes)
```

### Install by command

The prompt above walks Hermes through this. By hand, it is four commands and a browser approval:

```bash
hermes plugins install ClawLink-HQ/hermes-plugin --enable
hermes clawlink begin    # prints an approval link — open it and approve
hermes clawlink finish   # after approving in the browser
hermes clawlink test
```

Then connect Zendesk in the [ClawLink dashboard](https://claw-link.dev/dashboard) — a one-click OAuth approval, no API keys.

Verify the connection by asking Hermes:

> For ticket \<ticket id>, apply the macro \<macro id> with zendesk_apply_zendesk_macro, then show me the ticket's current state and draft a reply I can approve before you send anything.

### Using a different agent?

The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once Zendesk is connected in the dashboard, that agent calls the same 452 Zendesk tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## Zendesk MCP for Hermes

Looking for a Zendesk MCP server for Hermes Agent? ClawLink connects Zendesk to Hermes Agent and exposes 452 Zendesk tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Zendesk integration](https://claw-link.dev/openclaw/zendesk) runs on the same hosted Zendesk provider and the same 452 tools; OpenClaw installs ClawLink through a ClawHub skill instead of the Hermes pairing commands.

Zendesk is retiring API tokens. Accounts created after 2026-07-28 cannot use them, unused tokens deactivate after 30 days, and every remaining API token stops working on 2027-04-30, with OAuth as the migration path every search result now teaches. That deprecation is the strongest argument for this page's setup: a hosted OAuth connection has no token to be killed. Pair Hermes once with `hermes clawlink begin` and `hermes clawlink finish`, approve Zendesk's own consent screen, and the 452 tools below are callable from chat. No API key is generated, stored, or rotated, and nothing about the connection changes when Zendesk flips the switch next April. This is also an external-agent answer rather than Zendesk's own native AI agents, which live inside Admin Center and cannot reach outside tools like this integration can.

## What the Hermes Agent Zendesk integration can do

452 Zendesk tools are ready for Hermes Agent once the account is connected. The 30 below are the ones people reach for most; your agent can call all 452.

### 30 of 452 Zendesk tools for Hermes

| Tool | What it does |
|---|---|
| **Apply zendesk macro** `zendesk_apply_zendesk_macro` | Preview how a Zendesk macro would affect a ticket |
| **Autocomplete users** `zendesk_autocomplete_users` | Search for Zendesk users by name prefix |
| **Count zendesk organizations** `zendesk_count_zendesk_organizations` | Count the number of organizations in Zendesk |
| **Create automation** `zendesk_create_automation` | Create a new automation in Zendesk |
| **Create custom object record** `zendesk_create_custom_object_record` | Create a new custom object record |
| **Create many tickets** `zendesk_create_many_tickets` | Create multiple Zendesk tickets in bulk |
| **Create zendesk ticket** `zendesk_create_zendesk_ticket` | Create a new Zendesk ticket |
| **Autocomplete problems** `zendesk_autocomplete_problems` | Autocomplete problems in Zendesk |
| **Check host mapping validity for existing brand** `zendesk_check_host_mapping_validity_for_existing_brand` | Check the host mapping validity for an existing brand in Zendesk |
| **Count deleted users** `zendesk_count_deleted_users` | Count deleted users in Zendesk |
| **Count user ccd tickets** `zendesk_count_user_ccd_tickets` | Count tickets where the specified user is CCD (carbon copy distribution) |
| **Count zendesk custom object records** `zendesk_count_zendesk_custom_object_records` | Count the number of records in a specific Zendesk custom object |
| **Create autocomplete tags** `zendesk_create_autocomplete_tags` | Search for Zendesk tags using autocomplete via POST request body |
| **Create suspended tickets export** `zendesk_create_suspended_tickets_export` | Export Suspended Tickets from Zendesk Support |
| **Create views preview** `zendesk_create_views_preview` | Preview a Zendesk view by constructing conditions and execution settings to see which tickets |
| **Create views preview count** `zendesk_create_views_preview_count` | Preview ticket count for a view in Zendesk |
| **Detect best locale** `zendesk_detect_best_locale` | Detect the best language/locale for the current user based on their browser settings and |
| **Download custom object record attachment** `zendesk_download_custom_object_record_attachment` | Download attachment file from a Zendesk custom object record |
| **Get about me** `zendesk_get_about_me` | Get information about the currently authenticated user in Zendesk |
| **Get account settings** `zendesk_get_account_settings` | Retrieve Zendesk account settings |
| **Get active triggers** `zendesk_get_active_triggers` | List all active ticket triggers in Zendesk |
| **Get activities count** `zendesk_get_activities_count` | Count ticket activities in Zendesk |
| **Get all zendesk organizations** `zendesk_get_all_zendesk_organizations` | Get all organizations in Zendesk |
| **Get app** `zendesk_get_app` | Get a single Zendesk app by its numeric ID |
| **Get apps installations requirements** `zendesk_get_apps_installations_requirements` | List all requirements for a Zendesk app installation |
| **Get apps location** `zendesk_get_apps_location` | Get details for a specific Zendesk app location by its numeric ID |
| **Get apps location installations** `zendesk_get_apps_location_installations` | List all apps location installations from Zendesk |
| **Get apps public key** `zendesk_get_apps_public_key` | Retrieves the public key for a specific Zendesk app |
| **Get apps public key pem** `zendesk_get_apps_public_key_pem` | Retrieves the public key for a specific Zendesk app in PEM format |
| **Get attachment** `zendesk_get_attachment` | Retrieve details of a single Zendesk attachment by its ID |

## Example prompts

**Draft a reply with a macro**

> For ticket \<ticket id>, apply the macro \<macro id> with zendesk_apply_zendesk_macro, then show me the ticket's current state and draft a reply I can approve before you send anything.

**Staffing check**

> Call zendesk_get_about_me, then zendesk_autocomplete_users for "sup" and report which agents exist. Count how many tickets are currently assigned to each of them using zendesk_count_user_ccd_tickets.

**Organization overview**

> Use zendesk_count_zendesk_organizations and then list the organizations with their details. Tell me which ones have no tickets in the last 30 days, using zendesk_count_zendesk_custom_object_records only if needed.

**Bulk ticket creation**

> Create tickets for each issue in this list using zendesk_create_many_tickets, with subject, description, and priority as I specified. Give me the ticket ids and tell me before you send anything.

## How the Zendesk tools behave

Details that decide whether a Zendesk prompt is a quick answer or a rate-limited crawl.

- **Ids everywhere, names nowhere.** Tickets, organizations, macros, and custom object records are addressed by id. `zendesk_autocomplete_users` is how you turn a name into an id; an invented id fails permission-shaped.
- **The writes are customer-visible.** `zendesk_create_zendesk_ticket` and `zendesk_create_many_tickets` land in your help desk, macros apply to live tickets, and comments notify people. Say which step needs approval in the prompt.
- **Counting tools exist so sweeps do not.** `zendesk_count_zendesk_organizations`, `zendesk_count_user_ccd_tickets`, and `zendesk_count_deleted_users` answer totals in one call instead of walking the list.
- **Reads cover the admin surface.** Account settings, the about-me user, triggers, activities, and app installations are all readable, which makes an agent useful for audit-style questions without touching anything.
- **Previews and exports are separate tools.** `zendesk_create_views_preview` and the suspended-tickets export are distinct from the read tools, so a prompt asking for a view preview needs to name that tool or the agent picks the closest read.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Zendesk working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Connection flow** | Register a Zendesk app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect Zendesk through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Zendesk. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right Zendesk actions to the runtime in a format your agent can reliably use. | 452 tools for Zendesk are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes Zendesk to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Zendesk in the browser, and the 452 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### Hermes paired but still can't use Zendesk
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

### Connection succeeds but no tools appear
Reconnect Zendesk from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling Zendesk tools
Zendesk tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Zendesk call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### Zendesk returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### Zendesk returns 403 insufficient permissions although the account is connected
The engines and Zendesk's own support teach the cause order here, and this card now follows it. First check the OAuth grant: the connection must carry the scopes the failing tool needs, and if the grant was made with fewer scopes, reconnecting from the dashboard and approving the consent screen again is the fix. Second, the connected user's role: agent-vs-end-user decides what Zendesk lets through, and a connected account without agent rights fails actions that reads succeed on. Only then look at the argument: an invented or placeholder ticket or organization id returns a permission-shaped error even with perfect scopes, because Zendesk hides what you cannot see. State which of the three you checked before touching anything else.

Ask the agent to diagnose it:

```text
Call zendesk_get_about_me and zendesk_get_account_settings. Tell me which Zendesk user this connection acts as and which plan the account is on, then quote the exact error from the failed call. Do not retry the call yet.
```

### Zendesk starts returning 429 or the agent stalls mid-sweep
Zendesk rate-limits per plan at 200 to 2500 requests per minute, and an agent enumerating a large organization is exactly the shape that meets the limit: count, then list, then walk, one call at a time. A 429 is the API saying the minute is spent, so retrying immediately is wasted traffic. Change the shape of the work instead: ask for one ticket or a counted list, have the agent say what it intends to enumerate before it starts, and let a sweep run across turns rather than in one burst.

Ask the agent to diagnose it:

```text
Tell me how many Zendesk calls you have made in the last minute and what you were enumerating. Quote any rate-limit header or 429 text from the last response. Do not call Zendesk again until I reply.
```

### Zendesk tools are missing or a tool name is not found
Start the way Google's answer for this symptom starts: ask the agent to list all the Zendesk tools it has access to in a fresh chat. Tool schemas load on demand in this setup, so a fresh chat plus a forced list normally resolves the case where the catalog had not hydrated yet; wait-and-retry is the fallback, and reconnect from the dashboard is the last step if tools are still absent. If most tools work and a single name fails, the name is wrong rather than missing, and the error lists the closest real ones. What does not apply is the usual advice for this symptom, which assumes a local MCP server declared in a client config file with env-var auth; there is no local server here.

Ask the agent to diagnose it:

```text
List every Zendesk tool you currently have access to. If the list is empty, say so plainly and I will reconnect. If the list is full, tell me which tool creates a ticket and use that exact name on the next call.
```

### OAuth finished in the browser but the account is still missing
Try reconnecting Zendesk and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

### Is there a Hermes Agent Zendesk integration?
Yes. ClawLink is the fastest way to connect Hermes to Zendesk: link your Zendesk account once in the browser and Hermes Agent can call the Zendesk API through 452 ready-made tools — no custom code or token handling.

### How do I connect Zendesk to Hermes with ClawLink?
Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Zendesk in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

### How long does it take to connect Zendesk to Hermes Agent?
About two minutes. Sign in, click Connect next to Zendesk in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

### Why use ClawLink instead of wiring Zendesk up myself?
The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Zendesk working from chat.

### Why is "no API keys" the durable way to connect Zendesk now?
Because Zendesk is actively killing API keys. Per Zendesk's own deprecation, accounts created after 2026-07-28 cannot use API tokens at all, unused tokens are deactivated after 30 days, and all API tokens stop working on 2027-04-30 in favor of OAuth. Any setup that generates, stores, and refreshes a Zendesk token has a hard expiry date. A hosted OAuth connection signs in through Zendesk's consent screen and has no token file anywhere, so none of the three deprecation rules apply to it. This is the reason the page promises no API keys rather than merely preferring them.

### What can the agent do in Zendesk?
The tools cover the ticket surface and the administration around it: creating tickets and creating many at once, applying macros, autocompleting users, counting organizations and custom object records, reading account settings and the connected user, previews, and the export and app-inspection tools. Ticket creation and macro application are the writes that land in front of customers and colleagues, so those are the ones to say explicitly before letting the agent proceed. The read side is where agents earn their keep: an agent that can count organizations, list deleted users, and read account settings answers staffing and hygiene questions without anyone opening Zendesk.

### Is this Zendesk's own AI agent, or something separate?
Separate, deliberately. Zendesk's native AI agents live in Admin Center, are configured with click-to-connect steps, and operate inside Zendesk's own product. This integration is the external-agent route: Hermes is the agent, and Zendesk is one of the accounts it can touch from chat. That distinction matters because searches for "Zendesk AI agent without API key" are answered by Zendesk's native agents, which work fine when you want a bot on your help desk but do nothing for an agent that works across your other connected apps.

### Is it safe to connect Zendesk to an AI agent?
The mechanics of this connection are the answer: the OAuth grant is scoped to what the tool table on this page shows, there is no API key or token file to leak because none exists, and revoking from the ClawLink dashboard cuts access immediately. The searcher-level advice engines give is least privilege and draft mode, and both apply here: connect an account that only sees the support surface the agent should work on, and have the agent draft replies for approval before it sends them.

### Does this hit Zendesk API rate limits?
Zendesk documents plan-based limits: 200, 400, 700, or 2500 requests per minute depending on plan, with a 429 response past the allowance and a High Volume add-on for the top tiers. An agent that walks a large organization ticket by ticket is the traffic shape that meets them. Ask for one ticket or a counted list rather than a full sweep, and treat a 429 as a stop-and-wait signal rather than a retry trigger.

### Hermes paired but still can't use Zendesk
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

## Related

- [Hermes Gleap integration](https://claw-link.dev/hermes/gleap) — Gleap is an all-in-one customer feedback tool for apps and websites, enabling direct communication with users to build better software by discovering their everyday pain points.
- [Intercom tools](https://claw-link.dev/hermes/intercom) — Manage conversations, contacts, companies, and support articles
- [Connect Gorgias](https://claw-link.dev/hermes/gorgias) — E-commerce helpdesk for managing customer support tickets