UPS OAuth Authorization Code API Virtual Sandbox

Securely authenticate and authorize UPS service integrations using OAuth 2.0 and PKCE flows.

The UPS OAuth Authorization Code API enables secure integration of UPS services into your applications. It supports standard Authorization Code and PKCE-enhanced flows, allowing your customers to grant access to their UPS credentials without exposing them to your application. This ensures enhanced transaction security and operational efficiency through the use of access and refresh tokens.

Use this hosted sandbox to simulate UPS OAuth Authorization Code API APIs without authentication, API keys, or extra dependencies. Point your code or SDK to the Beeceptor base URL, preferably through an environment variable or feature flag, and switch back to the production API when ready. This keeps your integration code consistent across local development, QA, demos, and production.

Use cases:

Use this endpoint to validate OAuth handshake sequences, including authorization code exchange, PKCE code verifier/challenge verification, and token refresh logic. Developers can simulate successful authentication flows and error handling for invalid credentials or expired tokens before integrating with UPS production services.

UPS OAuth Authorization Code API virtual sandbox is up and running!

Use this sandbox URL as the API base in your code to simulate UPS OAuth Authorization Code API responses instantly.

`https://ups-oauth.mock.beeceptor.com`

OAuth Auth Code(3 operations)

GET

/v1/oauth/authorize

The Authorize Client endpoint initiates the OAuth Authorization Code flow by redirecting the user to UPS for logging-in and authorize the client application. To begin the authorization flow, the application constructs a URL using the application's client Id, the redirect URI, the scope of permissio

Query Parameter Name	Example
`client_id`*	`irure nisi`
`redirect_uri`*	`quis pariatur ut eu anim`
`response_type`*	`amet ullamco tempor cupidatat`
`state`	`Duis`
`scope`	`et mollit nostrud`
`code_challenge`	`in fugiat dolore irure`

Request Payload

Response Payload

Missing schema or example in the OpenAPI spec.
Update the definition and recreate the mock server.

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "unauthorized_client",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "invalid_request",
        "message": "Client authentication failed"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_grant",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_grant",
        "message": "Authorization code is invalid"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_grant",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Authorization code is invalid"
      }
    ]
  }
}

POST

/v1/oauth/token

The Generate Token endpoint exchanges the authorization code received from the client application for an access token and a refresh token. The client uses the access token to make API requests on behalf of the user by including it in the authorization header. The access token will expire after a ce

Request Payload

{
  "client_id": "afMRXZPQUOHhIy7sKuEL92JR",
  "code": "nbZcSDKScgKhkH4pyhWLvHqw7hhoijQk",
  "code_verifier": "OYVPrfQRDcSel0YIQgUADAipfIbKJXArhyxNvIP1ZObHPlc0",
  "grant_type": "authorization_code",
  "redirect_uri": "https://milky-basket.com/"
}

Response Payload

{
  "access_token": "eyJhbGciOiJQUzUxMiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3ODI5MTg5OTEsImV4cCI6MTc4MjkyNzQyOCwibmJmIjoxNzgyODU4ODY1LCJpc3MiOiJPJ0hhcmEgYW5kIFNvbnMiLCJzdWIiOiJlMzdkYTJiNC04OWJiLTQ4NDgtYjI4MC1iZTJjYzdkZDIxMzciLCJhdWQiOiIyZjQ2NjU3ZS0zNDI4LTQ3ZTEtYWZhOC1iYzczZDQxMTQ3M2QiLCJqdGkiOiIzOTliODBhNC0yMzc1LTQ3NTQtYjk2Mi0wMTM3ZDEyNzliMGQifQ.7TCunrBBPIpAaJnztVMYhsY9R0fuyjtKAFscDYMq0bl8lEC8SWGb1ojey5ZymT7i",
  "client_id": "VF3tdiQA6WKGFx8bEHi6MXyR",
  "expires_in": "6",
  "issued_at": "1772903128876",
  "refresh_count": "4",
  "refresh_token": "aEYhCKR7Fdjw2Kl3VNIq79rTIsiceQUbTscK62XqNiaQ6RVA2AItVpckZLDtRjMh",
  "refresh_token_expires_in": "4",
  "refresh_token_issued_at": "1780499371143",
  "refresh_token_status": "active",
  "scope": "write",
  "status": "approved",
  "token_type": "Bearer"
}

{
  "response": {
    "errors": [
      {
        "code": "unauthorized_client",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "unauthorized_client",
        "message": "Client authentication failed"
      },
      {
        "code": "unauthorized_client",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "unauthorized_client",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "invalid_grant",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "unauthorized_client",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Client authentication failed"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "invalid_request",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

POST

/v1/oauth/refresh

The /refresh endpoint is used to refresh an expired access token in order to continue accessing a UPS API on behalf of a user. The endpoint generates a new access/refresh token pair by exchanging a valid refresh token. A successful response returns new access and refresh tokens for ongoing API acce

Request Payload

{
  "grant_type": "authorization_code",
  "refresh_token": "WPcCZ13Er3oOXOxiGNFwuPmChwBnJQRvE3SQuoVB4zYFV3aaUunucCHyx2WXojej"
}

Response Payload

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3ODI5MjU4MjMsImV4cCI6MTc4MjkzMDAzNiwibmJmIjoxNzUzMDU5NzA5LCJpc3MiOiJDcm9uYSBMTEMiLCJzdWIiOiI0NDNhZDJjMC0xN2I3LTRjNTQtYTVjZC05ZDg4ODE2ZjI3ZjUiLCJhdWQiOiIwYmY3MmE5NS01MjQwLTQ0NTktODc5YS1mNjI3ODQwZGM3ZTAiLCJqdGkiOiI2OTAxOTIyOS0zNmZmLTQzODktYTU2Ni05MWNmMTNiOThhZDQifQ.KFaFux3Lavrz8EMJlaTHW4qySWLXfj7DrSHWCCqgnNUlRQlwpgT39J51kOrV5EDD",
  "client_id": "AqR1ON56Wz6XqbWkLrvXsKC8",
  "expires_in": "1",
  "issued_at": "1778156841932",
  "refresh_count": "8",
  "refresh_token": "v3mOmq5DNC2fW0bx1ZRmu6mqRaVn859shxML8ESiOWH4f6YsB2kV3vDjJ839hIL4",
  "refresh_token_expires_in": "5",
  "refresh_token_issued_at": "1774550644301",
  "refresh_token_status": "active",
  "scope": "shipping",
  "status": "approved",
  "token_type": "Bearer"
}

{
  "response": {
    "errors": [
      {
        "code": "unauthorized_client",
        "message": "Client authentication failed"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Client authentication failed"
      },
      {
        "code": "unauthorized_client",
        "message": "Client authentication failed"
      },
      {
        "code": "unauthorized_client",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_request",
        "message": "Authorization code is invalid"
      },
      {
        "code": "unauthorized_client",
        "message": "Authorization code is invalid"
      },
      {
        "code": "unauthorized_client",
        "message": "Redirect URI mismatch"
      },
      {
        "code": "unauthorized_client",
        "message": "Redirect URI mismatch"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "invalid_grant",
        "message": "Client authentication failed"
      },
      {
        "code": "invalid_grant",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Authorization code is invalid"
      },
      {
        "code": "invalid_request",
        "message": "Client authentication failed"
      }
    ]
  }
}

Service Homepage: github.com/UPS-API/api-documentation/blob/main/OAuthAuthCode.yaml

upsoauthauthenticationauthorizationshipping