Authentication

Every request must include a JWT bearer token issued for the warehouse you are operating on. The token has aud=services.3pl and encodes the warehouse ID in its sub claim.

Header format 🔗

1
Authorization: Bearer <token>

Token scope 🔗

• Each token is scoped to one warehouse. To operate on multiple 3PL fulfillment centers, issue one token per warehouse and route requests to the correct token per warehouse.
• The token's kid claim is matched against the warehouse's current key on every request. Rotating a warehouse's key immediately invalidates older tokens.
• View or rotate tokens from the warehouse record: Inventory & Stock > Locations > [Warehouse] > View access token. Only users with designated contact permission can view tokens.

Failure modes 🔗

Records outside the token's warehouse are silently filtered from list results rather than raising an error; individual lookups return 404.