To enhance security, UPS is making an important update to our OAuth API security model. Review the details below to determine if you need to take action to prepare for this upcoming change to the UPS Developer APIs.

What’s Changing?
Starting April 1, 2026, the lifespan of OAuth tokens will be reduced from 4 hours to 1 hour. This means your integration must generate a new token every hour instead of every 4 hours to maintain uninterrupted access to UPS APIs.

How This Impacts You
If your integration is hardcoded to refresh tokens every 4 hours, you might get “invalid credentials” errors after a token has been in use for 1 hour.

Check if You Need to Act
• No Action Needed: If you use the “expires in” value from the “Generate Token” response to refresh tokens.
• No Action Needed: If your integration refreshes tokens dynamically when encountering an “invalid credentials” error.
• Action Needed: If your integration is hardcoded to refresh tokens every 4 hours, you will need to update your logic.
What to Do
By April 1, 2026, ensure your integration uses one of the supported refresh methods mentioned above. For best long-term results, we recommend dynamic token refresh logic.