How authentication works in Zentor App
There is no developer API key system — only dashboard login and a widget embed token. Here is how both work.
Last verified: 2026-07-20
Zentor App currently does not offer a classic, permanent API key for developers. There are two real authentication paths: the dashboard login (session-based, for you as a user) and the widget embed token (for publicly embedding your chat widget on your website).
Step by step
- Understand the dashboard loginAfter logging in, you receive an access token valid for 12 hours, plus a refresh token valid for 7 days to stay logged in without re-entering your password. The access token is rotated on every refresh (single-use).
- Optionally enable two-factor authenticationYou can enable TOTP-based two-factor authentication (compatible with common authenticator apps) for your account, including backup codes for emergencies.
- Single sign-on (if available)If SSO (SAML/OIDC) is set up for your tenant, login can be enforced exclusively via your identity provider — regular password login is then disabled.
- Understand the widget embed tokenWhen you create your chat widget, a dedicated token is generated and shown in plain text only once. It is strictly limited to public widget endpoints (chat messages, rating, voice input/output) and grants no access to dashboard or admin functions. The calling domain is additionally checked against an allowlist.
Expected result
You understand which of the two real mechanisms (your own login vs. widget embedding) is relevant for your use case.
Common error cases
I am looking for an API key to run my own scripts against the Zentor App API.
Cause: No such developer API key system currently exists.
Resolution: The only way for programmatic access is the regular login endpoint followed by token usage — with the limitations described (expiry, session binding). For permanent integrations, contact Zentor.
My access token expires while I am running a script.
Cause: The access token is limited to 12 hours and must be renewed via the refresh endpoint.
Resolution: Implement token renewal via the refresh endpoint, or log in again as needed.
My widget token could accidentally retrieve dashboard data — is this a security risk?
Cause: No — the widget token is technically strictly limited to public widget endpoints and does not function as a substitute for a session login.
Resolution: No action needed; still treat the widget token as confidential, since it grants access to your widget in addition to the domain check.