In this article:

• OAuth 2.0
• Access tokens
• API rate limit

Ryder issues one set of Sandbox API credentials and one set of Production API credentials per customer account/profile. Additional API credential sets are not issued for individual users, applications, or integration processes within the same customer account.

OAuth 2.0

RyderShip V2 API uses OAuth 2.0 for API authentication. The credentials provided by Ryder (application_id and client_secret) establish the API connection for the customer account. Users then authenticate through the OAuth 2.0 authorization-code flow to obtain an access token that allows API requests to be made on behalf of that user.

This model supports multiple users and concurrent processes using the same customer account without requiring separate API credentials for each user or application. Each user can establish their own authenticated session and associated access/refresh tokens while using the same underlying customer API credentials.

Back to top

Access tokens

Access tokens are valid for 2 hours from the time they are issued. Once an access token expires, the integration can use the associated refresh token to obtain a new access token without requiring the user to repeat the initial authorization process.

For details on the OAuth 2.0 authentication flow, see the RyderShip V2 API authentication documentation.

Back to top

API rate limit

The API rate limit applies to the customer account/profile as a whole, not independently to each user or access token. The standard rate limit is 10 requests per second across all API activity associated with the customer account. Multiple users, applications, or concurrent processes must therefore collectively remain within this limit.

Customers are responsible for coordinating API request volume across their integration and ensuring that aggregate API activity remains within the applicable rate limit. See API Rate Limit Policy & Recommendations for additional details.

Back to top