# Implementing OAuth2 flows for B2B logistics integrations Canonical: https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html VW Tiguan R · 320 PS 4MOTION · discreet · direct EXPRESS COURIER · DIRECT · MON–SUN Courier service Switzerland. Express courier. Direct. Also overnight. x25pronto Switzerland takes goods direct to the destination. Small loads go by car. Larger loads go by van or Van XL. Direct, express and overnight trips run Monday to Sunday when a slot is free. Free times are shown in the booking calendar. This keeps the plan clear. [Calculate price](https://x25pronto.ch/en/#quote)[How overnight works](https://x25pronto.ch/en/overnight.html) Direct Mon–Sun Overnight Mon–Sun Car & van up to 1,000 kg COURIER INSIGHTS # Implementing OAuth2 flows for B2B logistics integrations A concise developer guide for logistics teams: choose the right OAuth2 flow (Client Credentials or Authorization Code), define scopes, secure redirect URLs and run a clear partner onboarding. 23 September 2026 ## Quick answer In short: pick the OAuth2 grant that matches your architecture (Client Credentials for server‑to‑server, Authorization Code with PKCE for user‑mediated flows). Keep scopes minimal, register https redirect URLs, protect client secrets, and run tests before issuing production credentials. ## 1. Choose the right grant type Use Client Credentials for server‑to‑server integrations without user interaction. Use Authorization Code with PKCE when an operator needs to grant access interactively. PKCE prevents code interception and is recommended for public clients. ## 2. Scopes and least privilege Define small, explicit scopes such as shipment.read, booking.create and booking.manage. Grant only the scopes the client needs. Document each scope clearly in your API docs so partners can request the correct permissions. ## 3. Redirect URLs and secure registration Require HTTPS for all redirect URLs and accept only pre‑registered URLs in production. Do not allow wildcards. For mobile apps or SPAs, use registered app schemes or PKCE. Validate redirect URLs at token exchange. ## 4. Client ID/Secret handling Issue Client Secrets to trusted server applications only. Store secrets in secure vaults and rotate them regularly. For public clients, avoid secrets and rely on PKCE. Log secret changes as part of onboarding. ## 5. Token lifetimes and refresh Keep access tokens short‑lived and use refresh tokens for Authorization Code clients where appropriate. For Client Credentials flows, obtain new access tokens on demand. Log token issuance and failures for audits and troubleshooting. ## 6. Partner onboarding checklist 1) Assign a technical contact. 2) Clarify client type (confidential/public). 3) Submit redirect URL(s). 4) Specify required scopes. 5) Receive test client credentials and use sandbox endpoints. 6) Review security practices and secret rotation. 7) Approve production credentials after tests. 8) Provide monitoring access and incident contacts. ## Frequently asked questions Which flow suits bulk batch jobs? Client Credentials is best for scheduled batch jobs and automated backend API calls without user interaction. How can I test redirect URLs without a production domain? Use dedicated test domains or secure https tunnelling tools. Register test redirect URLs separately and keep test and production credentials distinct. When should we add PKCE? Use PKCE for all public clients: SPAs and native/mobile apps. It secures the Authorization Code flow where a client secret cannot be kept. What logs are useful for security audits? Log timestamps, client IDs, requested scopes, response codes, request IPs and error details. Handle personal data per DSG/DSGVO rules. ## Plan a courier trip in Switzerland x25pronto Switzerland carries small and well packed shipments by car. Businesses can choose a direct courier trip or overnight service. Route, timing and shipment details can be entered online before booking. The guide price is then shown for the planned courier order. [Direct courier →](https://x25pronto.ch/en/direct-courier.html)[Overnight →](https://x25pronto.ch/en/overnight.html)[Services →](https://x25pronto.ch/en/services.html)[Calculate guide price →](https://x25pronto.ch/en/#quote) ### At a glance: Implementing OAuth2 flows for B2B logistics integrations Key points from this article. Follow the links to read each explanation. Choose the right grant type Use Client Credentials for server‑to‑server integrations without user interaction. [Read this section](https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html#courier-article-step-1) Scopes and least privilege Define small, explicit scopes such as shipment.read, booking.create and booking.manage. [Read this section](https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html#courier-article-step-2) Redirect URLs and secure registration Require HTTPS for all redirect URLs and accept only pre‑registered URLs in production. [Read this section](https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html#courier-article-step-3) Client ID/Secret handling Issue Client Secrets to trusted server applications only. [Read this section](https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html#courier-article-step-4) Partner onboarding checklist Clarify client type (confidential/public). [Read this section](https://x25pronto.ch/en/blog/implementierung-von-oauth2-flows-fur-b2b-logistikintegrationen.html#courier-article-step-6) More on this topic These guides cover related questions: [Implementing idempotency and retries in shipping integrations](https://x25pronto.ch/en/blog/idempotenz-und-retries-bei-versandintegration-implementieren.html) · [Implementing driver apps for GPS tracking](https://x25pronto.ch/en/blog/implementierung-von-fahrer-apps-fur-gps-tracking.html)