Delegated access to Zev products

Using the access token

Call the product's API with the access token, name the target in the product's own header, and never read targets from the token.

The access token is what a Zev product accepts from your app. Send it to the product’s API, never to ZevAuth.

# ZevCloud: the target is a team, named in x-team-id.
curl https://api.zevcloud.net/v1/... \
  -H "Authorization: Bearer eyJ..." \
  -H "x-team-id: team_42"

What to know

10 minutes. expires_in is 600. Cache the token and reuse it until shortly before it expires, then refresh. Do not refresh before every call.
For one product. A ZevCloud token is refused by every other product.
For one user. It acts as the user who consented, and only within what that user can still do in the product.
Opaque to you. It is a signed JWT, but treat it as a string. Its claims can change, and the product verifies it, not you.

Name the target on every call

The token never carries targets. On each call, you say which target you are acting on, in the product’s own header, for example the ZevCloud team. The product checks that this target is one the user picked, and that the user still holds the role there that lets them connect apps.

Read the header name, and which calls need it, from the product’s partner guide. For ZevCloud it is x-team-id, on every call; see ZevCloud’s connected apps guide. Other products are listed under Scopes by product.

When the product refuses a call

Products answer in their own words, but these meanings are shared:

Response	What it means	What to do
`401`	The token is expired, revoked, or older than the connection’s latest change.	Refresh once and retry. If the refresh fails with `invalid_grant`, the connection is gone; see Revocation.
`403` on a target	The user did not pick this target, or lost the role that allowed it.	Do not retry. Offer Manage teams (`prompt=configure`).
`403 high_risk_confirmation_required`	A high-risk permission’s confirmation ended.	Send the user through `prompt=reconfirm`. See High-risk permissions.
`403 scope_paused`	The permission is paused.	Do not retry. See Paused permissions.

A token minted before a change to the connection, such as a removed target or a paused permission, is refused as stale even if it has not expired. A refresh returns a token for the current version.

Updated at, Wednesday, October 21, 2026