Express courier. Direct.
Also overnight.
x25pronto Switzerland takes goods direct to the destination. Small loads go by car. Larger loads go by van or Van XL. Direct, express and overnight trips run Monday to Sunday when a slot is free. Free times are shown in the booking calendar. This keeps the plan clear.
Implementing OAuth2 flows for B2B logistics integrations
A concise developer guide for logistics teams: choose the right OAuth2 flow (Client Credentials or Authorization Code), define scopes, secure redirect URLs and run a clear partner onboarding.
Quick answer
In short: pick the OAuth2 grant that matches your architecture (Client Credentials for server‑to‑server, Authorization Code with PKCE for user‑mediated flows). Keep scopes minimal, register https redirect URLs, protect client secrets, and run tests before issuing production credentials.
1. Choose the right grant type
Use Client Credentials for server‑to‑server integrations without user interaction. Use Authorization Code with PKCE when an operator needs to grant access interactively. PKCE prevents code interception and is recommended for public clients.
2. Scopes and least privilege
Define small, explicit scopes such as shipment.read, booking.create and booking.manage. Grant only the scopes the client needs. Document each scope clearly in your API docs so partners can request the correct permissions.
3. Redirect URLs and secure registration
Require HTTPS for all redirect URLs and accept only pre‑registered URLs in production. Do not allow wildcards. For mobile apps or SPAs, use registered app schemes or PKCE. Validate redirect URLs at token exchange.
4. Client ID/Secret handling
Issue Client Secrets to trusted server applications only. Store secrets in secure vaults and rotate them regularly. For public clients, avoid secrets and rely on PKCE. Log secret changes as part of onboarding.
5. Token lifetimes and refresh
Keep access tokens short‑lived and use refresh tokens for Authorization Code clients where appropriate. For Client Credentials flows, obtain new access tokens on demand. Log token issuance and failures for audits and troubleshooting.
6. Partner onboarding checklist
1) Assign a technical contact. 2) Clarify client type (confidential/public). 3) Submit redirect URL(s). 4) Specify required scopes. 5) Receive test client credentials and use sandbox endpoints. 6) Review security practices and secret rotation. 7) Approve production credentials after tests. 8) Provide monitoring access and incident contacts.
Frequently asked questions
Which flow suits bulk batch jobs?
Client Credentials is best for scheduled batch jobs and automated backend API calls without user interaction.
How can I test redirect URLs without a production domain?
Use dedicated test domains or secure https tunnelling tools. Register test redirect URLs separately and keep test and production credentials distinct.
When should we add PKCE?
Use PKCE for all public clients: SPAs and native/mobile apps. It secures the Authorization Code flow where a client secret cannot be kept.
What logs are useful for security audits?
Log timestamps, client IDs, requested scopes, response codes, request IPs and error details. Handle personal data per DSG/DSGVO rules.