Australia Post · Authentication Profile

Australia Post Authentication

Authentication

Australia Post secures its APIs with apiKey and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and clientCredentials flow(s).

Address ValidationClick and CollectDeliveryE-CommerceLabelsLocationLogisticsParcel LockerPostalPostageShippingTrackingAustralia
Methods: apiKey, oauth2 Schemes: 3 OAuth flows: authorizationCode, clientCredentials API key in: header

Security Schemes

Bearer apiKey
· in: header (Authorization)
ApiKeyAuth apiKey
· in: header (AUTH-KEY)
OIDCSecurity oauth2
· flows: clientCredentials, authorizationCode

Source

Authentication Profile

Raw ↑ 
generated: '2026-10-21'
method: searched
source:
- https://auspost.com.au/developers/help-support/about-our-apis/
- https://auspost.com.au/developers/help-support/how-to-get-credentials/
- https://developers.auspost.com.au/apis/shipping-and-tracking/info/api-resources/faq
- openapi/australia-post-agency-data-delivery-openapi.yml, openapi/australia-post-endpoints-api-openapi.yml, openapi/australia-post-international-export-tools-v3-openapi.yml,
  openapi/australia-post-locations-v3-openapi.yml
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
schemes:
- name: Bearer
  type: apiKey
  in: header
  parameter: Authorization
  sources:
  - openapi/australia-post-agency-data-delivery-openapi.yml
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: AUTH-KEY
  sources:
  - openapi/australia-post-endpoints-api-openapi.yml
  - openapi/australia-post-locations-v3-openapi.yml
- name: OIDCSecurity
  type: oauth2
  flows:
  - flow: clientCredentials
    scopes: 1
  - flow: authorizationCode
    authorizationUrl: https://welcome.auspost.com.au/authorize
    tokenUrl: https://welcome.auspost.com.au/oauth/token
    scopes: 1
  sources:
  - openapi/australia-post-international-export-tools-v3-openapi.yml
docs: https://auspost.com.au/developers/help-support/about-our-apis/
documented_credential_types:
- type: API Key
  how: Include the API Key in the request header when you call one of our API endpoints.
  header: AUTH-KEY
  note: Key can be restricted by HTTP referrer, IP address or iOS bundle (native apps).
- type: Basic Auth
  how: 'Authorization: Basic Base64("api_key_uuid" + ":" + "api_key_password")'
  header: Authorization
  note: Used by the Shipping and Tracking API together with an Account-Number header (per the S&T FAQ).
  source: https://developers.auspost.com.au/apis/shipping-and-tracking/info/api-resources/faq
- type: OAuth 2.0 Client Credentials
  note: For machine-to-machine apps; APIs secured by the new identity provider (Auth0) or the legacy identity provider
    (AuthZ).
- type: OAuth 2.0 Authorisation Code
  note: Regular web apps; PKCE variant for single page and native apps.
app_types:
- Machine-to-machine (M2M)
- Regular web applications
- Single page web applications (SPA)
- Native applications
guidance: For best practice, only use API Key and Basic Auth with M2M apps.
transport: TLS 1.2 or above is required (Shipping and Tracking security considerations).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/australia-post-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.