AfterShip · Authentication Profile

Aftership Authentication

Authentication

AfterShip secures its APIs with apiKey, hmac-signature, and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

ShippingTrackingE-CommercePost-PurchaseNotificationLogisticsReturnsWarrantyAddress ValidationFulfillmentCarriersWebhookMCPRetail

Methods: apiKey, hmac-signature, oauth2 Schemes: 3 OAuth flows: API key in: header

Security Schemes

as-api-key apiKey

· in: header (as-api-key)

aes-hmac-sha256 http

scheme: signature

oauth2 oauth2

Source

Authentication Profile

generated: '2026-08-27'
method: searched
source: https://www.aftership.com/docs/tracking/quickstart/authentication
docs:
- https://www.aftership.com/docs/tracking/quickstart/authentication
- https://www.aftership.com/docs/tracking/quickstart/authentication/sign-string
- https://www.aftership.com/docs/tracking/quickstart/authentication/oauth/overview
- https://www.aftership.com/docs/tracking/quickstart/authentication/oauth/getting-started
- https://www.aftership.com/docs/tracking/quickstart/authentication/oauth/available-scopes
summary:
  types:
  - apiKey
  - hmac-signature
  - oauth2
  api_key_in:
  - header
  note: AfterShip documents three authentication methods. Every published OpenAPI declares only the apiKey scheme
    (as-api-key); AES/HMAC request signing and OAuth 2.0 are documented in prose and are NOT expressed in the specs.
schemes:
- name: as-api-key
  type: apiKey
  in: header
  parameter: as-api-key
  description: API key issued from the AfterShip developer portal (Settings -> API keys). Keys carry an "asat_"
    prefix.
  declared_in_openapi: true
  sources:
  - openapi/aftership-address-api-openapi.yml
  - openapi/_original/aftership-commerce-api-openapi.yml
  - openapi/_original/aftership-members-api-openapi.yml
  - openapi/_original/aftership-parser-api-openapi.yml
  - openapi/_original/aftership-personalization-api-openapi.yml
  - openapi/_original/aftership-protection-api-openapi.yml
  - openapi/aftership-returns-api-openapi.yml
  - openapi/_original/aftership-shipping-api-openapi.yml
  - openapi/aftership-tracking-api-openapi.yml
  - openapi/_original/aftership-warranty-api-openapi.yml
- name: aes-hmac-sha256
  type: http
  scheme: signature
  declared_in_openapi: false
  description: Signed-request mode. Sends as-api-key plus as-signature-hmac-sha256 (base64 HMAC-SHA256 of a canonical
    sign string) and a date header in RFC 1123 format. The computed signature is valid only within 3 minutes either
    side of the date header.
  headers:
  - as-api-key
  - as-signature-hmac-sha256
  - date
  source: https://www.aftership.com/docs/tracking/quickstart/authentication/sign-string
- name: oauth2
  type: oauth2
  declared_in_openapi: false
  description: OAuth 2.0 authorization-code flow for public apps registered in the AfterShip Partner Dashboard.
    Merchants grant scoped consent at install time; the app URL receives product, timestamp and an HMAC-SHA256 signature,
    then exchanges the grant for a token.
  authorization_server: https://accounts.aftership.com/auth/realms/business
  discovery: https://accounts.aftership.com/auth/realms/business/.well-known/openid-configuration
  authorization_endpoint: https://accounts.aftership.com/auth/realms/business/protocol/openid-connect/auth
  token_endpoint: https://accounts.aftership.com/auth/realms/business/protocol/openid-connect/token
  pkce:
  - S256
  - plain
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  source: https://www.aftership.com/docs/tracking/quickstart/authentication/oauth/getting-started
error_on_failure:
  http_status: 401
  meta_type: Unauthorized
  meta_code: 401
  message: The API key is invalid.
  observed: https://api.aftership.com/v4/openapi.json returned 401 with this envelope on 2026-08-27

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/aftership-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.