The Zendesk app

Running this admin from inside Zendesk Support, and who is allowed to.

What it is

VendorApp Admin is a Zendesk Support app that puts this entire admin area in your agents' left nav bar. It is the same admin you are reading about, on the same data — not a cut-down copy — so anything you can do at /manage/vendor you can do without leaving Support.

It is optional. The admin works exactly as well in its own browser tab, and nothing in this guide depends on the app being installed. Install it if your team lives in Zendesk and resents the tab switch.

NoteInside the embed the admin is scoped to one workspace and one app, so the tenant and app switchers are hidden. That is the only difference from the standalone admin.

Installing it

In Zendesk, go to Admin Center → Apps and integrations → Zendesk Support apps and install VendorApp Admin.
There is nothing to configure during installation. The app has no settings, asks for no API token, and stores no credentials in Zendesk.
A VendorApp icon appears in the left nav bar in Support. Click it.

NoteThe app installs once per Zendesk account, not per agent. Every agent sees the icon; who can actually get past the sign-in card is a separate question, answered below.

Signing in

The app opens on a Sign in with Zendesk card. Clicking it opens a popup on your own Zendesk subdomain asking you to authorize access; approve it and the admin loads in place.

The popup asks for read access only. That is not the connection your portals run on — it is a one-off identity check, used to establish which Zendesk agent is sitting at the keyboard and nothing else. It cannot change anything in your Zendesk.

TipThe sign-in runs in a popup, so a browser blocking popups for your Zendesk domain looks like the button doing nothing. That is the first thing to check.

NoteIn Safari and Firefox you may be asked to allow storage access the first time. Chrome and Edge handle it silently.

Who can open it

Four things must all be true, and they are checked in this order:

The Zendesk account has a workspace — its subdomain matches a connected VendorApp workspace.
The agent's Zendesk email appears on that workspace's Members page.
Their role there is Owner or Admin, not Viewer.
Their membership is active, and they have finished setting up their own sign-in.

CarefulThe match is on email address, and it is the agent's Zendesk email that counts — whoever approves the popup is who you are taken to be. An agent whose Zendesk profile uses a different address from their Members entry is refused, however senior they are.

NoteAdding someone to the Users page does not let them in. That list is portal users; the app reads Members. This is the single most common reason a sign-in is refused.

When sign-in is refused

The card names the specific reason rather than failing vaguely. Each one points at a different fix:

Not a member of this workspace: Their Zendesk email is not on Members at all. Add it there — spelled exactly as it is on their Zendesk profile.
You're a viewer: They are on Members, but read-only. Change their role to Admin.
Membership is disabled: They were disabled rather than removed. Re-enable them on Members.
Haven't finished setting up your sign-in: They were added but never accepted the invite. Resend it from Members.
Bring VendorApp to your team: Not a refusal. This Zendesk has no workspace connected to it — the app is being opened from an account we do not know yet.

TipEvery one of these is fixed on the Members page, and none of them needs anything changed in Zendesk.