The EchoSync Authorizer is the authentication service for the EchoSync platform. It validates your application credentials and issues Bearer tokens that grant access to EchoSync APIs.
Not every EchoSync API uses the Authorizer, and not every one requires a Bearer token. Check which applies to the API you are calling:
| API | Accepted authentication |
|---|---|
| Carrier API | Bearer token from this service |
| Pricing API | Bearer token from this service, or Basic Authentication |
| Shipper API | Basic Authentication only — does not use this service |
Production: https://auth.echo.com
EchoSync Authorizer uses a token-based authentication flow. Submit your application credentials to receive a Bearer token, then include it in the Authorization header of each request to an API that accepts Bearer tokens.
Reuse your token until it expires. Do not request a new token on every API call. Cache the token and use it for its full validity period. Requesting new tokens repeatedly within the same validity window may trigger rate limiting.
- Access tokens are valid for 86400 seconds (24 hours) from the time they are issued.
- The endpoint
/tokenresponse includes:expires_in— token lifetime in seconds (used to determine when the token should be refreshed)scope— the permissions granted to the token, defining which APIs it can access
- A
401 Unauthorizedresponse from any EchoSync API indicates the token is expired or invalid. In this case, request a new token and retry the request.
To ensure fair usage, maintain service availability, and protect system performance, requests may be subject to rate limiting. When usage exceeds allowed thresholds, requests can be temporarily throttled or rejected until the limit window resets.