Authentication

Get an access token

POST /v1/api-clients/token

Exchanges an API key (client_id + client_secret, created at my.parcelhub.ca → Account → API keys) for a bearer token. Tokens last about 15 minutes; when a call returns 401, get a new one. Send it as Authorization: Bearer <access_token> on every other call. A read-only key gets a token that may only read and request quotes.

No token needed: this call is how you get one.

Request body

• client_id • Required string

  The key's client id (ph_client_…).

• client_secret • Required string

  The key's secret (ph_secret_…), shown once when the key was created.

Response in data

• access_token • Required string
• expires_at • Required string
• kid • Required string

1
2
3
4
5
6

curl -X POST "https://api.parcelhub.ca/v1/api-clients/token" \
  -H "Content-Type: application/json" \
  -d '{
  "client_id": "3f2b8c1e-5d6a-4b7c-9e0f-1a2b3c4d5e6f",
  "client_secret": "your-client-secret"
}'

1
2
3
4
5
6
7
8
9

{
  "ok": true,
  "data": {
    "access_token": "eyJhbGciOi…",
    "expires_at": "string",
    "kid": "string"
  },
  "request_id": "01JBX7Q2…"
}

Spec for your key

GET /v1/openapi.json

The full OpenAPI document for the token that fetches it, including dashboard-only endpoints not listed in this reference. Each operation has x-caller-allowed: whether this token may call it.

Response in data

See the example on the right.

1
2

curl "https://api.parcelhub.ca/v1/openapi.json" \
  -H "Authorization: Bearer $TOKEN"

1
2
3
4
5

{
  "ok": true,
  "data": null,
  "request_id": "01JBX7Q2…"
}