Authentication

Every endpoint except /health and /readyz needs your API key, sent as a bearer token:

Authorization: Bearer <api-key>

Your key is issued by E-Parcel, one per environment, and reaches everything under /api/v1/*. A key only sees its own shipments: asking for any other shipment id returns 404, exactly as if it did not exist.

A missing or unrecognised key returns 401:

{ "detail": "invalid API key" }

Treat a 401 as a configuration error. Alert a human; retrying will not help.

Keep the key on your server

The key ships parcels on your account

Anyone holding the key can create billable shipments in your name.

• Read it from the environment (for example EPARCEL_API_KEY) or your secret manager. Never hard-code it or commit it to version control.
• Never send it to a browser or a mobile app. Call E-Parcel from your backend.
• Never log it, print it or include it in a support message.
• Don’t paste it into a chat with an AI assistant. Let the agent read it from the environment instead. See AI coding agents.

Rotating a key

Contact E-Parcel to rotate a key or to get an additional one, for example one per sales channel.