Authentication

The Partner API uses OAuth 2.0 with the client_credentials grant. You exchange a client_id and client_secret for a short-lived Bearer access token, then send that token on every request.

Obtaining Credentials

Credentials are issued by the Spedisci.online team — there is no self-service signup. You receive:

Value	Description
`client_id`	A UUID identifying your application, e.g. `9f4c1e2a-7b3d-4a10-8c55-6de0f1b2a3c4`
`client_secret`	A 40-character secret. Shown once, at creation time

The client secret cannot be recovered. If it is lost, contact support to have a new client issued.

Requesting an Access Token

POST https://delivery.spedisci.online/oauth/token

Body Parameters

Field	Type	Required	Description
`grant_type`	`string`	Yes	Must be `client_credentials`
`client_id`	`string`	Yes	Your client id
`client_secret`	`string`	Yes	Your client secret
`scope`	`string`	No	Leave empty — no scopes are required

cURL


curl -X POST https://delivery.spedisci.online/oauth/token \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "9f4c1e2a-7b3d-4a10-8c55-6de0f1b2a3c4",
    "client_secret": "your_client_secret"
  }'

Request


{
  "grant_type": "client_credentials",
  "client_id": "9f4c1e2a-7b3d-4a10-8c55-6de0f1b2a3c4",
  "client_secret": "your_client_secret"
}

Response


{
  "token_type": "Bearer",
  "expires_in": 31536000,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp0aSI6IjZm..."
}

Response Fields

Field	Type	Description
`token_type`	`string`	Always `Bearer`
`expires_in`	`number`	Token lifetime in seconds
`access_token`	`string`	The JWT to send on subsequent requests

Cache the token and reuse it until it is close to expiry. Do not request a new token per API call.

Using the Access Token

Send the token in the Authorization header of every /api/v2026-04/* request:


Authorization: Bearer <access_token>

Example


curl https://delivery.spedisci.online/api/v2026-04/tracking/ABC123456789 \
  -H "Authorization: Bearer <access_token>" \
  -H "Accept: application/json"

Keep your credentials and tokens secure. Never expose them in client-side code, mobile apps or public repositories — the token grants access to the tracking data of every shipment on the platform.

Authentication Errors

Code	Meaning	Cause
`400`	Bad request	Malformed token request (missing `grant_type`, wrong grant)
`401`	Unauthorized	Missing, malformed, expired or revoked access token
`401`	Invalid client	Wrong `client_id` / `client_secret` at the token endpoint

If a request fails with 401, verify that:

The Authorization header is present and formatted exactly as Bearer <token> (note the space)
The token has not expired — request a fresh one
You are calling the correct environment (the token from one environment is not valid on another)