Authorization

Obtaining and using an API key

Please reach out to your account manager to obtain API keys for your test account and for your live account. Keep the API keys stored safely, as they provide write access to your account. Never publish API keys to version control.

The API key should be used in the password field of Basic Authentication with all requests. There is no username required, and the string must be base64 encoded per spec.

Note: The API key goes in the password field with an empty username. The leading colon (:) indicates an empty username field when encoding, and is required.

Manual Base64 Encoding

# Encode your API key with leading colon
echo -n ":your_api_key_here" | base64
# Result: OnlvdXJfYXBpX2tleV9oZXJl

Tagging requests with X-Request-Source

If several of your systems share one API key, you can add the optional X-Request-Source header to tell their requests apart. Set it to a short alias for the system making the call, such as billing-sync or tms-nightly-import.

curl -iX POST "$AUGMENT_API_BASE_URL/v2/auth-check" \
  -u ":$AUGMENT_API_KEY" \
  -H "X-Request-Source: billing-sync"

What Augment does with it:

• Records it with the request. Augment logs the value together with the ID of the API key that made the request. We use it to tell which of your systems sent a request when we investigate an issue or look into a change.
• It is a label, not an identity. Augment does not use it for authentication, authorization, rate limiting, or billing. It is not unique per key, and anyone holding the key can set any value.
• It is optional. Requests without it behave exactly as before.
• Values are cut at 255 characters. Anything longer is shortened to the first 255 characters.
• Do not put personal data or secrets in it. Use letters, digits, spaces, and . _ : / @ -.

Testing the API key

We have an auth check endpoint that will allow you to test your API key without writing any data to your account. Use our auth check endpoint to verify your API key without writing data to your account. Great for setup and troubleshooting, but not intended for automated production health checks.

Example Requests

The curl request will look like the following:

curl -iX POST "$AUGMENT_API_BASE_URL/v2/auth-check" \
  -H "Authorization: Basic OnlvdXJfYXBpX2tleV9oZXJl"

Or by passing the API key in the -u flag:

curl -iX POST "$AUGMENT_API_BASE_URL/v2/auth-check" \
  -u ":$AUGMENT_API_KEY"

Creating a load with API key auth (with sample payload):

curl -iX POST "$AUGMENT_API_BASE_URL/v2/loads" \
  -H "Authorization: Basic OnlvdXJfYXBpX2tleV9oZXJl" \
  -H "content-type: application/json" \
  -d '{"brokerage":{},"load":{"loadNumber":"1","mode":"FTL","status":"DRAFT","route":[{"sequence":1,"stopActivity":"PICKUP","expectedArrivalWindowStart":"2025-09-01T12:00:00Z","expectedArrivalWindowEnd":"2025-09-01T14:00:00Z","address":{"street1":"1 Santa Monica Blvd","city":"Santa Monica","stateOrProvince":"CA","postalCode":"90401","country":"US"}},{"sequence":2,"stopActivity":"DELIVERY","expectedArrivalWindowStart":"2025-09-02T12:00:00Z","expectedArrivalWindowEnd":"2025-09-02T14:00:00Z","address":{"street1":"1 Market St","city":"San Francisco","stateOrProvince":"CA","postalCode":"94105","country":"US"}}]}}'

Error Handling

Security Best Practices

• Environment Variables: Get API keys from environment variables, not source code
• Separate Environments: test account API keys will not work in live, and viceversa
• Access Control: Limit API key access to only the systems that need it

Key Management

The API key never expires. However, the key can be revoked. We will be providing key revocation and key rotation functionalities in the near future, accessible from the Augment portal.

If a key needs to be revoked, please reach out to your account manager. You will be asked to provide the key to revoke.

Q4 2025

• Self-service key management via Augment portal
• Automated key rotation capabilities