Flexport Credential and Token Boundary
Overview
Prefer a distinct endpoint-scoped OAuth client for each workload. Treat broad API keys as an explicit exception, and budget token acquisition because client-credential tokens last 24 hours while token requests are limited to 10 per day.
Prerequisites
- Named workload owner and exact endpoint inventory
- Flexport administrator access to API Credentials
- Secret store, redacted audit sink, and rotation procedure
Instructions
Step 1: Choose the credential type
Use OAuth client credentials for new integrations so endpoint resources can be selected. Accept an API key only after documenting why its broad access is necessary.
Step 2: Create one credential per system
Separate production, non-production, and independent workloads. Flexport does not let operators add endpoints to an existing credential, so create a replacement when scope must expand.
Step 3: Request a token once
POST to /oauth/token with client_id, client_secret, audience https://api.flexport.com, and grant type client_credentials. Never expose the secret in a browser, shell history, or receipt.
Step 4: Cache by credential
Store the JWT and expiry in a concurrency-safe cache. Refresh before expiry with jitter and a single-flight lock; do not spend the 10-request daily token budget per business request.
Step 5: Prove least privilege
Run one approved read against every required endpoint and one negative test against an endpoint outside the credential resource set.
Step 6: Rotate without ambiguity
Create and validate a replacement, switch one workload, observe it, then revoke the old credential. Record only credential aliases, timestamps, and outcome.
Authentication
REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions.
Tool Discipline
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Flexport-side change.
Output
- Scoped decision or implementation artifact
- Redacted operation and validation receipt
- Failure, rollback, and follow-up ownership record
Return a machine-reviewable receipt in this shape; adapt the operation values, but never place credentials or provider payloads in it:
surface: rest-v3
operation: shipment-read
decision: approved
outcome: verified
evidence:
release_sha: recorded-out-of-band
provider_reference: redacted
rollback_owner: logistics-platform
Examples
A shipment reader gets its own OAuth client for shipment endpoints. All workers share one encrypted cached token, while a separate invoice importer receives a different client rather than reusing the shipment credential.
Error Handling
| Failure | Response | | --- | --- | | Token request rejected | Check audience, grant type, client identity, and secret source; do not loop. | | Daily token budget threatened | Stop per-request acquisition and repair shared caching/single-flight behavior. | | Required endpoint missing | Create a new scoped credential; do not silently substitute a broad key. | | Secret disclosed | Revoke or rotate immediately and scrub derived logs or artifacts. |