Authentication and workspace scope

Every request needs Authorization: Bearer and X-Parcel-Workspace: <workspace_id>. Tokens are scoped to one workspace. Both credentials must identify the same workspace; a mismatch returns HTTP 403 with code workspace_mismatch. Do not resolve a mismatch by removing the workspace header.

Read operations require shipments:read. Creating a shipment requires shipments:write. Webhook signing secrets are different credentials and cannot authorize API calls. Missing or invalid bearer credentials return HTTP 401 with code invalid_token. Changing request scopes or refreshing a revoked token requires operator action. Never retry 401 or 403 automatically with the same credentials.

There is no public token endpoint in this documentation. The token issuance process is outside this benchmark. In examples, use placeholders rather than inventing a usable token. Create shipment lists the remaining required headers.