PacSortDevelopers
02 / Authentication

One key. One header.

Send Authorization: Bearer YOUR_API_KEY with authenticated requests. You do not need to exchange the key for a separate login token.

cURL · check authentication
curl 'https://api.pacsortonline.com/health/auth' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json'
200 OK · expected response
{
  "status": "ok"
}
Trying it in the API reference?

Open the authentication endpoint in the API reference. Click Authorize and paste only your key (without Bearer), then apply credentials. Open GET /health/auth, choose Try it out and Execute. The reference adds the header for you.

Replace YOUR_API_KEY with your own key. Keep it on your server and out of shared examples, screenshots and source control.

Key lifetime, permissions & replacement

QuestionPacSort Online answer
How long is my key valid?Company API keys have no configured time-based expiry. They are long-lived credentials, not expiring portal session tokens. Access still depends on the key and associated account remaining valid.
How do I refresh it?There is no public refresh-token endpoint or OAuth refresh flow for this API. If the key is revoked or no longer accepted, request a replacement from your administrator or PacSort Online contact, update your server configuration and test GET /health/auth.
Which scopes do I request?This API does not expose OAuth scope names or a separate “Shipment” scope. The key resolves to a customer account; assignment access is checked against its company. Enabled delivery services are account configuration, not token scopes.
Which credentials go in the header?Only the PacSort Online key in Authorization: Bearer YOUR_API_KEY. Do not send a portal session token, a carrier login header or a carrier API key to this API.

For planned rotation, test the replacement key, switch your integration, then arrange revocation of the old key. Ask support to confirm revocation has taken effect; do not assume it is instantaneous.