Build Shipment Integrations with ShipPack

ShipPack's Developer Platform gives you a dedicated developer profile for creating integration applications, testing shipment workflows safely, requesting production access, authenticating server-to-server requests, and receiving signed shipment webhooks.

A new user can register directly as a developer. An existing customer, driver, company, entity, vendor, or supplier can add developer access to the same verified ShipPack identity without creating a duplicate user.

What You Can Build

The public MVP is intentionally focused on secure shipment integrations.

🧩 Integration Applications

Create isolated applications and manage environment-specific credentials from the developer dashboard.

📦 Shipment Workflows

Read package and delivery catalogs, create shipments, list them, retrieve details, and cancel supported shipments.

🧪 Sandbox Simulations

Create non-operational test shipments and drive them through a controlled lifecycle without charges or driver assignments.

🚀 Approved Production Access

Create operational shipments only after an administrator approves the application's production use case.

🔔 Signed Shipment Webhooks

Subscribe to lifecycle events, verify HMAC signatures, inspect delivery attempts, and manually retry failed deliveries.

MVP scope boundary

Public wallet, warehouse, driver, admin, card-tokenization, and high-frequency GPS APIs are not exposed. Internal assignment, payment-provider, pricing, and ShipPack user fields are also excluded from the public contract.

Quick Start

Move from registration to a production-ready application in five deliberate steps.

01Register and verify a developer profile.

02Create an application and sandbox key.

03Load catalogs and create a test shipment.

04Simulate its lifecycle and verify webhooks.

05Request production access and create a live key.

Platform Surface

Each public surface has a clear identity and security boundary.

Surface	Purpose
Developer identity	A first-class developer profile attached to a ShipPack user identity
Applications and keys	Dashboard-managed applications with sandbox or approved production credentials
Catalog resources	Package sizes, delivery types, and route-aware delivery options
Sandbox shipments	Safe test shipments, controlled lifecycle simulation, and sandbox webhooks
Production shipments	Application-scoped operational shipments after production approval
Signed webhooks	Shipment lifecycle callbacks with HMAC-SHA256 signatures and delivery logs

Architecture and Ownership

The MVP extends ShipPack's existing services instead of introducing a standalone developer microservice.

Responsibility	Owner
Developer accounts, applications, and credentials	user-service
Sandbox shipment simulation	user-service developer domain
Public API gateway and developer identity generation	user-service
Operational production shipments and pricing	shipment-service
Shipment lifecycle event consumption	notification-service
Webhook configuration, signing, logs, and retries	user-service queue

Developer Tools

OpenAPI 3.1 Contract

The server-to-server contract is maintained at openapi/shippack-developer-api.json and is the source for generated clients and types.

TypeScript SDK Source

The first server-side SDK lives at sdks/typescript and covers credentials, catalogs, shipments, structured errors, retries, timeouts, trace IDs, and webhook verification.

Postman Collection

Registration, dashboard, key-management, production-access, and admin-review workflows remain in the maintained Postman collection rather than secret-key SDKs.

Webhook Delivery Logs

Inspect callback status, HTTP response details, truncated response bodies, and the last delivery error before retrying.

Popular Guides

Start with the workflow closest to your integration stage.

Register a developer profile Create a sandbox shipment Authenticate API requests Configure signed webhooks Use the OpenAPI contract Prepare for production

Base URL

Sandbox and production credentials use the same developer API base URL.

https://dev.api.theshippack.com/api/v1/developer

Environment	Key prefix	Behavior
Sandbox	sk_test_	No charge, operational shipment, or driver assignment
Production	sk_live_	Approval required; wallet submission is the MVP payment method

Authentication

Server-to-server developer API requests use an application secret key.

http

Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keep secrets recoverable by rotation, not storage

Secret keys are returned only when created. ShipPack stores a SHA-256 hash, key prefix, environment, expiry, and revocation state. If a secret is lost, create or rotate it. Credentials are limited to 120 requests per minute.

Dashboard routes use a normal Sanctum user token plus X-App-Type: developer.
Application secret keys are only for the server-to-server developer API.
Never expose sk_test_ or sk_live_ credentials in browser or mobile client code.

What would you like to explore

Personal details