Authentication
Authenticate every request with a token scoped to your company—and keep those credentials out of source control.
Most Cargobase endpoints require a token-style credential. The OpenAPI document for each collection defines the exact securitySchemes entry; in practice you almost always send:
Authorization: Token <your_access_token>
Bearer <your_access_token> is also accepted as an alternate scheme where documented in the API reference.
How to get a token
Shippers and providers request credentials from Cargobase—tokens are not created in this portal. Follow Get API access for what to email, Sandbox vs Production, and what happens after you receive a credential.
Typical pattern
- Obtain an API token for the environment you intend to call (Get API access).
- Attach that token on every request using the scheme documented for the collection (default: Token).
- In the interactive reference, open Authentication, paste the token once, and reuse it across operations in that session.
Staff vs partner credentials
- Shipper and provider tokens are scoped to the integrating company.
- Operations APIs are for Cargobase staff. Access to those docs requires a
@cargobase.comGoogle Workspace login; calling the APIs still needs a valid staff credential from the OAS security scheme.
Never commit tokens to source control. Rotate any credential that may have been exposed.