Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesConnect a chatbot to a help desk through a server-side integration service: use the support platform’s API when the bot needs to request or change information, and use webhooks when the platform needs to notify your service about an event. Keep credentials out of browser code, verify incoming webhook requests, and design for rate limits and failed deliveries.
APIs and webhooks do different jobs
A support API is the request-and-response route. Your bot’s backend sends a request to the support platform to perform an action or retrieve information—for example, to look up a record or create a ticket. Zendesk’s API documentation covers several product areas, including tickets, users, organizations, Help Center, Chat, and voice; available operations depend on the specific API and account.
A webhook is an event-notification route. The support platform sends an HTTP request to a URL you configure when a subscribed event occurs. Zendesk’s examples include sending a request when a ticket is created or a user is deleted. Its documentation also covers invocation monitoring, retries, and signing-secret verification.
| Connection pattern | Who initiates the request? | Useful for | What to plan for |
|---|---|---|---|
| Support API | Your bot’s backend | On-demand reads and writes, such as retrieving or creating support records | Authentication, endpoint-specific limits, errors, and safe retry behavior |
| Webhook | The support platform | Notifying your service about a subscribed support-side event | A reachable HTTPS receiver, request verification, duplicate-safe processing, delivery monitoring, and retry handling |
Many integrations use both: the bot calls the API for an action the customer requests, while a webhook informs the integration service about a later support-side change. This is a design pattern, not a claim that every platform exposes the same endpoints or events.
#1 Best Overall
Choose the connection around the support action
For a bot-initiated lookup or update
Use an API request when the bot needs an answer or needs to perform a write at that moment. First identify the record and operation involved—such as a ticket, user, or help-center item—and confirm the platform’s relevant API supports it for your account. Do not assume that one API’s permissions or data model automatically applies to another product area.
For a support-side event
Use a webhook when an event in the help desk should prompt your service to act. Configure only the event types the integration needs, then have the receiver verify the request before changing bot state or starting another workflow. Since delivery attempts may fail and retries can occur, make event handling safe to repeat rather than assuming a request arrives exactly once.
For an action that crosses both directions
Keep each leg explicit. For example, a customer request can lead the bot backend to call the support API; a later webhook can then notify your service of a subscribed platform event. The API call and webhook are separate transactions, so record enough status to determine what happened at each stage.
A practical connection workflow
- List the bot’s actions and the events it must hear about. Separate on-demand reads and writes—such as ticket creation or status lookup—from platform-originated notifications. Check that the relevant API and event types exist for the product and account you use.
- Put an integration service between the public bot and the help desk. The service can authenticate requests, apply business rules, and translate between the bot’s conversation state and the support platform’s data model. Store credentials in server configuration or a key-management system. OpenAI’s API guidance says API keys are secrets and should not be exposed in browser or app client-side code; the same server-side protection is a sound boundary for support-platform credentials.
- Configure authentication for each direction. Use a method the destination platform currently supports. For Zendesk webhook destinations, the documentation describes API key, basic, or bearer authentication and says to use HTTPS/TLS. If webhook signing is enabled, verify the signature with the signing secret before trusting the request.
- Implement API calls and webhook handling as distinct paths. The bot service makes API calls for bot-initiated reads or writes. A webhook receiver handles platform-originated events. Validate a webhook before acting on it, and make processing idempotent—for example, keep track of event identifiers or another suitable deduplication key if the event payload provides one. That is an implementation safeguard inferred from documented retries and signature verification, not a guarantee about duplicate delivery.
- Handle limits and transient failures deliberately. Read available rate-limit information, monitor usage, and, for Zendesk API responses with status 429, wait for the documented
Retry-Afterinterval instead of retrying immediately. Use bounded retries and backoff for transient problems; avoid an unbounded retry loop that can amplify an outage or exhaust a quota. - Test with non-production credentials and representative events. Exercise successful reads and writes, rejected authentication, rate limiting, malformed or unverifiable webhook requests, and repeat delivery. Then monitor API activity and webhook invocation attempts in production, along with errors, request identifiers, and remaining rate-limit information where available. Zendesk documents monitoring for API activity and webhook invocations; this does not imply a hands-on test of any particular integration.
Zendesk limits and account details to account for
The figures below are Zendesk documentation figures accessed October 4, 2026. They apply to the named account category or API, not to chatbot APIs in general. Limits and plan names can change.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Zendesk surface | Documented limit or account rule | Qualification |
|---|---|---|
| Support and Help Center API requests | 200 requests per minute on Suite Team; 400 on Growth and Professional; 700 on Enterprise; 2,500 on Enterprise Plus | Zendesk Developer Docs rate limits; varies by Suite plan. Some endpoint limits may be adjusted by Zendesk. |
| Chat API endpoints | 200 requests per minute | Zendesk Developer Docs Live Chat introduction; specific to the Chat API, not a general chatbot limit. |
| Webhooks on trial accounts | Maximum of 10 webhooks and 60 invocations per minute | Zendesk Developer Docs webhooks reference; applies to trial accounts. |
Rate limits can differ by endpoint as well as plan. A design that fits the general Support API allowance may still encounter a more restrictive endpoint limit, so use the limits documented for the operation you call. When Zendesk returns 429, follow its Retry-After guidance rather than immediately resending the request.
Plan for API-token changes
Zendesk Customer Care’s support article, edited August 20, 2026, says unused API tokens automatically deactivate starting July 28, 2026, and all API tokens stop working by April 30, 2027. Because the first date has passed and the final cutoff is upcoming as of October 4, 2026, identify any token-based integrations and plan a move to a supported alternative, such as OAuth where appropriate. Confirm the current authentication options for the specific Zendesk product and account before changing production credentials.
Security and reliability checks
- Keep secrets on the server. Do not put API keys in browser JavaScript, mobile-app bundles, or public repositories. Restrict access to the integration service and rotate credentials according to your organization’s process.
- Use HTTPS for webhook delivery. Zendesk’s webhook documentation specifies HTTPS/TLS for destinations. Avoid sending support data to an endpoint that cannot protect it in transit.
- Verify the sender before processing. Where signing is enabled, validate the signature with the configured secret. Authentication and signature checks address different concerns: a destination credential controls access, while signature verification lets a receiver check that a signed request is authentic and has not been altered.
- Expect delivery failures. Zendesk documents retries for certain failed webhook responses and a circuit breaker. Your receiver should return an appropriate response only after it has handled the event reliably, and your team should monitor failed invocations rather than treating delivery as assured.
- Make retries safe. API retries and webhook redeliveries can otherwise repeat a write or workflow. Use bounded retry policies and duplicate-safe event processing; do not presume the platform guarantees exactly-once delivery.
- Minimize data movement. Pass only the customer and ticket information the operation needs, and define how long your integration stores it. The platform-specific sources cited here do not establish a universal retention rule for chatbot integrations.
What the Zendesk example does—and does not—establish
Zendesk’s documentation provides concrete examples of API surfaces, webhook configuration, authentication choices, limits, and delivery monitoring. Those details make it possible to plan a Zendesk integration, but they should not be generalized to Intercom, Salesforce, or another support platform. A comparable, current endpoint-by-endpoint assessment across vendors is not established here, nor are cross-vendor prices, plans, or complete authentication requirements.
For another platform, compare its official documentation on the same practical points: API actions and data objects; available webhook events; authentication and signature verification; plan- or endpoint-specific limits; retry behavior and delivery visibility; and access to tickets, users, messaging, and help-center content. The right choice is the integration surface that exposes the exact actions and events the bot requires, with security and failure handling your service can operate.
Recommended Free Tools
Frequently Asked Questions
Does a webhook return the answer to the chatbot’s API request?
No. An API call is the bot service’s request-and-response interaction; a webhook is a separate HTTP notification sent when a configured event occurs. If a conversation needs an immediate lookup result, the bot needs an API response path rather than relying on a later event notification.
Rank #4
Can I use a single rate limit for every Zendesk endpoint?
No. Zendesk documents plan-based limits for Support and Help Center requests, a separate Chat API limit, and account-specific webhook limits. Check the documentation for the exact API surface and endpoint your integration uses.
Should the webhook receiver perform a long-running bot workflow before responding?
Keep receipt handling reliable and observable. If downstream work may fail or take time, persist or queue the validated event before returning success, then process it asynchronously. This is an integration design recommendation; the cited Zendesk documentation does not prescribe a particular queue or application architecture.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Frequently Asked Questions
Does a webhook return the answer to the chatbot’s API request?
No. An API call is the bot service’s request-and-response interaction; a webhook is a separate HTTP notification sent when a configured event occurs. If a conversation needs an immediate lookup result, the bot needs an API response path rather than relying on a later event notification.
Can I use a single rate limit for every Zendesk endpoint?
No. Zendesk documents plan-based limits for Support and Help Center requests, a separate Chat API limit, and account-specific webhook limits. Check the documentation for the exact API surface and endpoint your integration uses.
Should the webhook receiver perform a long-running bot workflow before responding?
Keep receipt handling reliable and observable. If downstream work may fail or take time, persist or queue the validated event before returning success, then process it asynchronously. This is an integration design recommendation; the cited Zendesk documentation does not prescribe a particular queue or application architecture.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
