> ## Documentation Index
> Fetch the complete documentation index at: https://nango.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler (OneAPI) - How do I link my account?

## Overview

To connect with Zscaler OneAPI, you need:

1. **Vanity Domain**, **Authentication Domain**, and **API Host** — where your tenant logs in and which Zscaler cloud it runs on.
2. **Client ID** and **Client Secret** — from an API client you create in ZIdentity.
3. **ZPA Customer ID** — your Zscaler Private Access (ZPA) tenant ID, used in ZPA API paths.

### Prerequisites

* A Zscaler tenant on ZIdentity, with a OneAPI subscription.
* An Authentication Service (ZIdentity) admin with full permission on the **API Clients** and **API Resources** modules.

### Step 1: Find your vanity domain and cloud

Look at the address you use to log in to ZIdentity, such as `acme.zslogin.net`:

* Your **vanity domain** is the part before the first dot, such as `acme`.
* The rest of the address, such as `zslogin.net`, tells you which Zscaler cloud your tenant runs on. Pick the matching **Authentication Domain** and **API Host** from the table:

| Zscaler cloud | Login address | Authentication Domain | API Host |
| - | - | - | - |
| Production (commercial) | `<vanity>.zslogin.net` | `zslogin.net` | `api.zsapi.net` |
| Beta | `<vanity>.zsloginbeta.net` | `zsloginbeta.net` | `api.beta.zsapi.net` |
| Government (FedRAMP, `.net`) | `<vanity>.zidentitygov.net` | `zidentitygov.net` | `api.zscalergov.net` |
| Government (FedRAMP, `.us`) | `<vanity>.zidentitygov.us` | `zidentitygov.us` | `api.zscalergov.us` |

Most tenants are on production, which is the default. Always pick the Authentication Domain and API Host from the same row.

> [!NOTE]
>
> Zscaler doesn't offer a self-hosted OneAPI. Every tenant runs on one of the Zscaler clouds above.

### Step 2: Create an API client

> [!NOTE]
>
> Before you create the API client, add an API role in each Zscaler service you want to access, such as Internet & SaaS (ZIA) and Private Access (ZPA). These roles sync to the Authentication Service and appear as scopes on the API client. Without them, you can't assign resources to the client.

1. In the Zscaler Admin Console, go to **Administration** > **API** > **API Clients**.
2. Click **Add API Client** and select **New Client**.
3. On the **Client** tab, fill in:
   * **Name** and **Description**
   * **Status** — enable it so the client can get access tokens.
   * **Access Token Validity** — in minutes, between 1 minute and 24 hours.
   * **Grant Types** — select **Client Credentials**.

![Zscaler Add API Client page with the Client tab open](https://mintcdn.com/nango/hBmxexkqo28SqiGC/api-integrations/zscaler/add_api_client.png?fit=max\&auto=format\&n=hBmxexkqo28SqiGC\&q=85\&s=bbc81fedc055c0d368d7a3979ad91279)

4. Under **Client Authentication**, select **Secret** and click **Add**. Copy the secret now, as it isn't shown again. A secret is valid for 30 to 365 days.

![Zscaler Client Authentication section with a client secret added](https://mintcdn.com/nango/hBmxexkqo28SqiGC/api-integrations/zscaler/secret.png?fit=max\&auto=format\&n=hBmxexkqo28SqiGC\&q=85\&s=1e09dfff91e138be985a47abbf069e12)

5. On the **Resources** tab, select the API resource (scope) for each Zscaler service the client can access, such as a read-only ZIA role and a read-only ZPA role.

![Zscaler Resources tab listing the scopes for each Zscaler service](https://mintcdn.com/nango/hBmxexkqo28SqiGC/api-integrations/zscaler/resources.png?fit=max\&auto=format\&n=hBmxexkqo28SqiGC\&q=85\&s=f8b0612c762aa32804bc876332cb1313)

6. Click **Save**.
7. Copy the **Client ID** from the **API Clients** page. You can also find it in the client's **Edit API Client** drawer.

![Zscaler Edit API Client page showing the Client ID field](https://mintcdn.com/nango/hBmxexkqo28SqiGC/api-integrations/zscaler/edit_client.png?fit=max\&auto=format\&n=hBmxexkqo28SqiGC\&q=85\&s=7a68f6caf3492297e1edac0ad19cd1c4)

### Step 3: Find your ZPA customer ID

In the ZPA admin console, go to **Configuration & Control** > **Public API** > **API Keys**. Your customer ID is shown on that page.

### Step 4: Enter your details in the Connect UI

1. Open the form where you need to authenticate with Zscaler.
2. Enter your **Vanity Domain**, select your **Authentication Domain** and **API Host**, and enter your **ZPA Customer ID**, **Client ID**, and **Client Secret**.
3. Click **Connect**.

![](https://mintcdn.com/nango/hBmxexkqo28SqiGC/api-integrations/zscaler/form.png?fit=max\&auto=format\&n=hBmxexkqo28SqiGC\&q=85\&s=c0a8ea799c35f85cf25ace633b7cdaac)

You are now connected to Zscaler.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.