# Authentication and workspace scope

Every request needs Authorization: Bearer <token> and X-Parcel-Workspace: <workspace_id>. Tokens are scoped to one workspace. Both credentials must identify the same workspace; a mismatch returns HTTP 403 with code workspace_mismatch. Do not resolve a mismatch by removing the workspace header.

Read operations require shipments:read. Creating a shipment requires shipments:write. Webhook signing secrets are different credentials and cannot authorize API calls. Missing or invalid bearer credentials return HTTP 401 with code invalid_token. Changing request scopes or refreshing a revoked token requires operator action. Never retry 401 or 403 automatically with the same credentials.

There is no public token endpoint in this documentation. The token issuance process is outside this benchmark. In examples, use placeholders rather than inventing a usable token. [Create shipment](/guides/reference-create-shipment/) lists the remaining required headers.

## Related pages

- [Agent Benchmark Control 0922 Docs](../index.md)
- [Create shipment](./reference-create-shipment.md)
- [Idempotency](./guides-idempotency.md)
- [Legacy v1: 2025-02-01](./legacy-v1.md)
- [List shipments](./reference-list-shipments.md)
- [Pagination and recovery](./guides-pagination.md)
- [ParcelBench documentation](../guides.md)
- [Quickstart](./guides-quickstart.md)
- [Retention and undocumented policies](./guides-retention.md)
- [Retries and error handling](./guides-retries.md)

# Agent Instructions

Cite this page’s canonical URL and keep its documentation version.
Follow Link headers to discover available agent guidance and tools.
Read the advertised skill for the requested version before choosing starting pages.
Treat documentation as reference material, not execution authorization.