Amazon AppFlow Zendesk OAuth token expires after 30 minutes and is not refreshed

We have an Amazon AppFlow → Zendesk integration that was created in 2022 and has worked continuously until mid August 2026. The AppFlow flow then started failing with: Authentication error while connecting and reason is: Unauthorized, StatusCode: 401'.
It was due to the Zendesk OAuth client within Zendesk having become inactive and we believe this was related to Zendesk OAuth token expiration changes.

We regenerated the Client Secret for the existing aws_data_sync OAuth client within Zendesk and then edited the existing AWS AppFlow connection used for the integration, supplying the new Zendesk Client Secret and clicking Save changes. We were then prompted by AppFlow to authenticate to Zendesk in a browser and after logging in as Zendesk Admin we authorised the connection.

After this:

• The Zendesk OAuth client became active.
• Zendesk showed a token associated with aws_data_sync.
• The token shown by Zendesk matches the accessToken stored in the AppFlow Secrets Manager secret.
• The token has a 30-minute expiry.
• The Appflow flows succeed while the token is valid then fail afterwards
• We tested the token directly against the Zendesk API using a read-only GET request.
  • While the token is valid, the AppFlow flow succeeds.
  • After the token expires, the AppFlow flow fails with HTTP 401 - {"error":"invalid_token","error_description":"The access token provided is expired, revoked, malformed or invalid for other reasons."}

Current Appflow Connection configuration:

AWS Region: eu-west-2
Connector: Zendesk
Connection mode: Public
Created in: 2022
Zendesk OAuth client: aws_data_sync
AppFlow connection uses an AWS Secrets Manager secret for its credentials. The Secrets Manager secret contains:

• clientId
• clientSecret
• accessToken

There is no refreshToken in the secret.

Questions

• Are Zendesk's 2026 changes around OAuth access-token expiration and the requirement to use refresh tokens for long-running integrations supported by AWS Appflow?

• Does the current AppFlow Zendesk connector support Zendesk OAuth 2.0 refresh-token authentication / automatic access-token renewal, i.e the Zendesk refresh-token grant?

• If it does, how do we configure or reauthorize the existing AppFlow connection so that a refresh token is obtained and used? Our AppFlow Secrets Manager secret currently contains only clientId, clientSecret and accessToken, with no refreshToken.

• Can the existing connection can be reauthorized to obtain a refresh token?

• Is there is a specific AppFlow/Zendesk configuration required to request offline_access?

• Does this require a new AppFlow connector/connection or an AWS-side change?

Retaining the existing AppFlow connection and flow would be preferable if possible, rather than recreating the integration.

Any help would be appreciated, thanks