Leaf Logistics Authentication

generated: '2026-08-25'
method: probed
source: https://api.leaflogistics.com/v1/graphql
note: >-
  DERIVED FROM LIVE PROBES, NOT FROM A PUBLISHED SPEC. Leaf Logistics publishes no developer portal
  and no authentication documentation, so this profile records only what the API host itself
  disclosed to an anonymous request. Nothing here is inferred beyond the verbatim error bodies.
api: Leaf Logistics Platform API
base_url: https://api.leaflogistics.com/v1/graphql
engine:
  product: Hasura GraphQL Engine
  version: v2.35.1
  server_type: ce
  console_type: pro-lite
  evidence: >-
    https://api.leaflogistics.com/v1/version returned {"server_type":"ce","version":"v2.35.1"};
    https://api.leaflogistics.com/console embeds window.__env with serverVersion "v2.35.1" and
    consoleType "pro-lite".
schemes:
- name: jwt
  type: http
  scheme: bearer
  bearer_format: JWT
  in: header
  header: Authorization
  observed: true
  evidence: >-
    Anonymous POST to /v1/graphql returns HTTP 200 with body
    {"errors":[{"message":"Missing 'Authorization' or 'Cookie' header in JWT authentication mode",
    "extensions":{"path":"$","code":"invalid-headers"}}]} — Hasura's HASURA_GRAPHQL_JWT_SECRET mode.
- name: cookie
  type: apiKey
  in: cookie
  observed: true
  evidence: >-
    The same error names "Cookie" as an accepted alternative to the Authorization header, which is
    how the app.leaflogistics.com single-page application authenticates against the same endpoint.
oauth2: unknown
openid_connect: unknown
issuer_discovery:
  checked:
  - url: https://api.leaflogistics.com/.well-known/openid-configuration
    status: 404
  - url: https://www.leaflogistics.com/.well-known/openid-configuration
    status: 403
  - url: https://api.leaflogistics.com/.well-known/oauth-authorization-server
    status: 404
  result: >-
    No discovery document is served on any host, so the JWT issuer, signing keys and any scope
    vocabulary could not be established anonymously.
docs: null
docs_note: >-
  No public authentication reference exists. Leaf's shipper FAQ says only that it will integrate
  "through email, phone, fax, EDI, API — whatever you prefer"
  (https://www.leaflogistics.com/shippers/), i.e. credentials and integration detail are handled in
  onboarding.