Authentication

Send your key in either header:

Authorization: Bearer lsk_live_…
x-api-key: lsk_live_…

Every /v1/* route needs a key except GET /v1/carriers.

Without a keyCopy Anchor Link

GET /v1/track/{trackingNumber} works once a day without a key, per IP address, to try the API. A malformed number or a failure on our side doesn't use it up. After that:

{ "error": { "code": "payment_required", "message": "You've used today's free lookup. Pay with MPP (see the WWW-Authenticate header): $0.50 by card for 25 tracking numbers. Or sign up at https://app.lastscanned.com for 5 free lookups a day." } }

Pay per requestCopy Anchor Link

Agents can pay instead of signing up, with MPP. A tracking request without a key (once the free lookup is used, and always for GET /v1/track?numbers=) answers 402 Payment Required with a WWW-Authenticate: Payment challenge. Pay and retry with Authorization: Payment …; any MPP client does this for you.

The paid request spends what it looks up, and only if it gets an answer (a result, or the carrier saying it has no such number). What's left comes back as a credit key, in the x-lastscanned-key header and a credits field:

{ "carrier": "ups", "status": "in_transit", "…": "…", "credits": { "key": "lsk_pack_…", "remaining": 24 } }

Send it like an API key on later tracking requests. Each response has x-lastscanned-credits with what's left. Credit keys work only for /v1/track; when one runs out you get 402 credits_used, and a request without the key pays again.

Paid routes and prices are also listed at https://api.lastscanned.com/openapi.json.

KeysCopy Anchor Link

• A key is lsk_live_ followed by 32 hex characters.
• It is shown once, when it is made. Only a hash is stored, so a lost key can't be recovered; make a new one.
• Create and revoke keys in the dashboard, or with POST /v1/keys and DELETE /v1/keys/{prefix}. The prefix is lsk_live_ plus the key's first 8 hex characters, e.g. lsk_live_1a2b3c4d.
• All keys on an account share its usage and limits.

Call the API from your server. It sends no CORS headers, so browsers can't call it directly, and a key in front-end code is a leaked key.

401 UnauthorizedCopy Anchor Link

{ "error": { "code": "unauthorized", "message": "Invalid API key" } }

Returned for a missing, malformed or revoked key, or a disabled account.