One key. One header.
Send Authorization: Bearer YOUR_API_KEY with authenticated requests. You do not need to exchange the key for a separate login token.
cURL · check authentication
curl 'https://api.pacsortonline.com/health/auth' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-H 'Accept: application/json'200 OK · expected response
{
"status": "ok"
}Trying it in the API reference?
Open the authentication endpoint in the API reference. Click Authorize and paste only your key (without Bearer), then apply credentials. Open GET /health/auth, choose Try it out and Execute. The reference adds the header for you.
Replace YOUR_API_KEY with your own key. Keep it on your server and out of shared examples, screenshots and source control.
Key lifetime, permissions & replacement
| Question | PacSort Online answer |
|---|---|
| How long is my key valid? | Company API keys have no configured time-based expiry. They are long-lived credentials, not expiring portal session tokens. Access still depends on the key and associated account remaining valid. |
| How do I refresh it? | There is no public refresh-token endpoint or OAuth refresh flow for this API. If the key is revoked or no longer accepted, request a replacement from your administrator or PacSort Online contact, update your server configuration and test GET /health/auth. |
| Which scopes do I request? | This API does not expose OAuth scope names or a separate “Shipment” scope. The key resolves to a customer account; assignment access is checked against its company. Enabled delivery services are account configuration, not token scopes. |
| Which credentials go in the header? | Only the PacSort Online key in Authorization: Bearer YOUR_API_KEY. Do not send a portal session token, a carrier login header or a carrier API key to this API. |
For planned rotation, test the replacement key, switch your integration, then arrange revocation of the old key. Ask support to confirm revocation has taken effect; do not assume it is instantaneous.