DISCOVER

    GOVERNANCE · REGULATION · SAFETY · PRACTICE

    NOV 01, 2026

    BY H.B. HAYES

    The Desk 06

    Zendesk stopped issuing new Support API tokens on Oct 27. New York's new AI law spares support bots only if they stay on topic.

    The Desk, edition 06: a ring of old keys hanging from a nail, one with a paper tag dated Apr 30, 2027, and a single new blue key on the desk below, beside the words: Count the keys.

    THE DESK 06 · TWO STORIES · ABOUT FIVE MINUTES

    Two stories this week. One has a hard date. The other has a condition most support bots were never tested against. Both come down to the same question: do you know what's connected to your queue, and what it's allowed to say?

    01 · Every tool that reaches your Zendesk with a Support API token can act as any user today, and it stops working Apr 30, 2027.

    What happened. Zendesk announced on June 1, 2026 that it is removing Support API tokens as a way to sign in to its API. Since Oct 27, 2026, no Zendesk account can create a new Support API token, in the admin screens or through the API. Tokens that already exist keep working until Apr 30, 2027. On that date every remaining one is deactivated for good. Zendesk says there is no opt-out and no extension.

    There's a second clock already running. Since July 28, 2026, a Support API token that goes unused for 30 days is deactivated on its own. Sixty days after that, it's deleted.

    Zendesk is plain about why. In its words, a token "can be used to impersonate any user in your account, including admins." It lists "no rotation mechanism" and "no expiration" among the problems.

    What it means. Zendesk names what breaks: webhooks that update tickets, custom scripts for automation or data syncs, third-party integrations built by contractors, and middleware where nobody touches the Zendesk screens. It also says automated processes "may fail silently," and that a failed sign-in doesn't show which token was used.

    So here's how I read it.. the AI tool your team wired in last spring may be running on a key with admin reach, no expiry, and no named owner. And if it breaks in April, nobody may notice until the tickets pile up.

    The fix is an inventory, not a project. Zendesk's migration guide starts there too: list every active Support API token in Admin Center, then find what uses each one. Each token shows a "Last used" date. OAuth and Support API tokens can run side by side until Apr 30, 2027, so you can move one integration at a time.

    One detail worth knowing before you move. With OAuth's client credentials setup, Zendesk says actions are attributed to the user who created the OAuth client, "typically an admin." Decide who that person is on purpose.

    Where it doesn't apply. Queues not on Zendesk. Integrations already on OAuth. Only Support API tokens are affected: the Ticketing, Help Center and Voice APIs. Zendesk says tokens for Messaging, Chat and its other products are not part of this change. Zendesk's own actions in action flows don't use tokens, but a Support API token inside a custom action will stop working. So will a token used in a webhook that calls back into your own Zendesk.

    02 · New York's AI companion law exempts customer service bots only if they can't talk about anything else.

    What happened. On Oct 28, 2026, Governor Hochul signed S.9051-B, now chapter 368 of 2026. It adds a new article to New York's General Business Law. The bill text says it takes effect Jan 1, 2027. The law bars "unsafe AI companion features" for minors, a list of twelve that starts with a bot suggesting it's human. Operators have to check whether a user is a minor, and offer more than one way to do it. The attorney general can seek civil penalties of up to $25,000 per violation, and individuals can sue.

    The reach is wider than companion apps. The law covers any "generative artificial intelligence system with a natural language interface" that "provides ongoing, adaptive responses to user inputs."

    What it means. The twelve features are banned for minors, not for every user. But a covered bot can only offer them to someone it has checked isn't a minor, so in practice the age check reaches everyone who uses it.

    There's a carve-out for customer service. It applies when the bot is offered solely for customer service, or for information about a business's products, services or customer accounts, "provided that the covered AI companion is unable to respond on topics outside of the specified purpose."

    That last clause is the queue question. A support bot that will happily chat about the weather, write a poem, or play along with a customer who wants a friend is not "unable to respond" off topic. Whether that pulls it under the law is for your lawyer. Whether your bot stays on topic is something you can test yourself.

    Where it doesn't apply. It isn't in force yet. The bill text says Jan 1, 2027; check the chaptered law for the final date before you plan around it. Systems a business uses only for internal purposes or employee productivity are carved out with no off-topic condition. A bot already held to customer service topics fits the exemption as written. And I'm not your lawyer. Ask yours whether you're covered, and whether customers outside New York change the answer.

    From Desk 05

    New York City's proposed rule on support bots is still open. The City's notice set written comments and the public hearing for Nov 19, 2026, with the hearing at 11:00 AM by phone and video. The City's rules site now lists Dec 18, 2026 for both, so check the rule page before you file.

    Worth knowing, not worth your Monday

    Colorado's attorney general held the hearing on its chatbot and automated decision rules on Oct 26, 2026, and comments closed that night. The Chatbot Safety Act takes effect Jan 1, 2027. I haven't confirmed from the bill text how it treats customer service bots, so I'll come back to it when I have.

    One thing to do this week

    The token roll call. Open Admin Center, then Apps and integrations, then APIs, then API tokens. Write down every active Support API token, the tool that uses it, its "Last used" date and one named owner. Count the tokens.. then count the owners.

    Pass line: every token has a tool, an owner and a date to move to OAuth before Apr 30, 2027. A token nobody can explain gets an owner or a shutoff date this week, on purpose, instead of in April by surprise.

    Every other Zendesk date between now and 2028 is in our guide, Zendesk changes in 2027: the dates and what breaks.

    Frequently asked questions

    Do Zendesk API tokens still work?

    The ones you already have do, for now. Since Oct 27, 2026, nobody can create a new Support API token, and a token left unused for 30 days is deactivated on its own.

    When do Zendesk Support API tokens stop working?

    Apr 30, 2027. Zendesk deactivates every remaining one that day, with no opt-out and no extension, so anything still on a token needs to move to OAuth before then.

    Does New York's AI companion law apply to customer service chatbots?

    Not if the bot is offered only for customer service and can't respond on topics outside that purpose, which is the exemption in New York State's S.9051-B. A support bot that will chat about anything may not fit it, so test yours and ask your lawyer.

    Sources

    H.B.

    The Desk is original writing from Copious. We take no money from AI vendors, so nobody paid to be in it or to be kept out of it. If I got something wrong, tell me at hello@copious.app. I'll fix it and say so.

    Next edition: Sunday, Nov 8, 2026.

    Copious takes no money from AI vendors. Nothing here is placement.