About OAuth 2.0-based authentication

Shipium supports the use of OAuth 2.0 clients to authorize requests to connect with our APIs.

OAuth 2.0 clients are not persistent, and their access tokens must be refreshed periodically. This is different from using API keys, which are persistent and remain valid until deactivated.

Use your organization's OAuth 2.0 client by providing it in the Authorization request header of the API call:

1. Retrieve an access token using /oauth/token.
2. OPTIONAL: Validate your access using ping.
3. Make calls to Shipium's APIs using the access token.
4. Refresh your access token when it expires.

📘

For more information about OAuth 2.0

• A basic introduction to OAuth 2.0, with Grant Type: Client Credentials as the most relevant section
• OAuth 2.0 Servers
• The OAuth section of our Terms and Definitions

Alternatively, you can probably use a library in your preferred language to do much of this.

Prerequisites

• You must already have created an OAuth 2.0 access key or API key. You can find instructions for doing so in Create API Credentials.
• You must have your OAuth Client ID and OAuth Client Secret you saved to run the examples as you go through this guide.

Replace example data with your data

The following examples all use fake test information for a fake organization. You should replace the values shown in this table with your organization's specific account values. Shipium uses the term partner to refer to our customers. Partner used in the following table refers to your organization.

Authenticate and get a token for use in other APIs

This section describes how to get a token that your organization can use to start making calls to Shipium's APIs.

Retrieve an access token

This is step 1. You will use the bearer access token this generates in the following steps.

Replace the oauthClientId and oauthClientSecret in the following client uniform resource locator (cURL) request example with your own values. Keep the AUTHORIZATION_SERVER line as is.

cURL

PARTNER_OA_CLIENT_ID='oauthClientId';
PARTNER_OA_SECRET='oauthClientSecret';
AUTHORIZATION_SERVER='https://auth.shipium.com';

curl --request POST --location "$AUTHORIZATION_SERVER/oauth/token" \
  --user "$PARTNER_OA_CLIENT_ID:$PARTNER_OA_SECRET" \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials'

You should receive a JavaScript Object Notation (JSON) response like the following (this example is pretty-printed for clarity):

JSON

{
  "access_token":"Q8ZUeEJHcv2uhfsco=",
  "token_type":"bearer",
  "expires_in":6008,
  "scope":"auth-service shiptime-service",
  "partnerId":"3060a3db-0678-4459-bd2e-f7c501ee4b3f",
  "partnerIds":"3060a3db-0678-4459-bd2e-f7c501ee4b3f",
  "userId":"BOZSGCL4SMOEDSKA96ZK"
}

Validate your access by calling the ping API

This is (optional) step 2. You can check to ensure a proper connection.

The ping API primarily exists so that you can debug your programmatic connection to Shipium servers during testing and integration. It always returns back a JSON object with a status=1 and info="pong".

To validate:

1. Replace <ACCESS_TOKEN> in the first line below with the access token you received in the response to step 1, including its trailing =. Keep the RESOURCE_SERVER as shown in this example.
2. Make the cURL request shown below.

cURL

ACCESS_TOKEN='<ACCESS_TOKEN>';
RESOURCE_SERVER='https://api.shipium.com';

curl -X GET \
  --url "$RESOURCE_SERVER/api/v1/deliveryexperience/ping" \
  --header 'accept: application/json' \
  --header "Authorization: Bearer $ACCESS_TOKEN" ;

The ping API should respond with JSON that resembles the following example:

JSON

{
  "info": "pong",
  "status": 1
}

Refresh an expired access token

This is step 4. You will use the initial token for some time before you need to follow the steps here to refresh your access token.

When you retrieved your initial access token, the response contained an element called expires_in, which is the number of seconds before the token must be refreshed. Once this time period has elapsed, your calls will fail due to your access token being invalid and you'll receive a 401 response from the server.

You must refresh your token by calling the /oauth/token endpoint again as in the original example.

cURL

PARTNER_OA_CLIENT_ID='shipium_provided_user';
PARTNER_OA_SECRET='SomeFairlyLongRandomLookingString';
AUTHORIZATION_SERVER='https://auth.shipium.com';
AUTH=`echo -ne "$PARTNER_OA_CLIENT_ID:$PARTNER_OA_SECRET" | base64`;

curl --location --request POST "$AUTHORIZATION_SERVER/oauth/token" \
  --user "$PARTNER_OA_CLIENT_ID:$PARTNER_OA_SECRET" \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials';

Once you've refreshed your authorization, you can call ping again to confirm your connection.

Resources

Your Shipium team member is available to help along the way. However, you might find these resources helpful:

• Terms and Definitions
• Troubleshooting Guide
• Contact Shipium Support