Currently viewing services in North America. Change region?

Changelog

This page tracks the implemented Developer Platform MVP contract. It avoids product-version claims that are not present in the committed API specification.

The current milestone establishes developer identities, application-scoped credentials, safe shipment simulation, production approval, and signed shipment lifecycle webhooks.

Current Milestone

Release name

ShipPack Developer Platform MVP
🧩 Developer Identity
Developer is a first-class profile type. Existing eligible ShipPack users can add it to the same verified identity.
🗂️ Applications and Credentials
Developer accounts own applications, environment-specific keys, shipments, and webhook endpoints.
🧪 Sandbox Shipment Simulation
Test shipments use SPTEST and TRKTEST identifiers and progress through a controlled lifecycle without charges or driver assignment.
🚀 Production Access Review
Applications submit an operational reason and require administrator approval before creating sk_live_ credentials.
📦 Public Shipment API
The OpenAPI contract covers credentials, catalogs, shipment list/create/retrieve/cancel, and sandbox simulation.
🔔 Signed Webhooks
Application endpoints receive signed shipment events with logs, retries, secret rotation, testing, and manual retry controls.

Security and Isolation

  • Secret keys are returned once and stored as SHA-256 hashes with prefix, environment, expiry, and revocation metadata.
  • Credentials are limited to 120 requests per minute.
  • Production access must be approved; rejecting access revokes active live keys.
  • Production callers cannot select an internal ShipPack user ID.
  • Caller-supplied prices are discarded.
  • Application shipment mappings prevent cross-application access.
  • Webhook URLs require HTTPS and reject localhost, private, reserved, and locally resolving targets.
  • Webhook signatures use HMAC-SHA256 over the timestamp and raw body with a five-minute replay tolerance.

OpenAPI and SDK Contract

The OpenAPI 3.1 source is maintained at:

openapi/shippack-developer-api.json

The first server-side SDK source is maintained at:

sdks/typescript

Release gate

An SDK must pass its Docker build, tests, and OpenAPI operation-coverage check. It must not be published when generated operations differ from the committed specification.

Implementation Verification

The MVP source reports the following local verification results.

AreaCoverageResult
User-service developer/authentication suite52 tests190 assertions
User-service OTP verification suite9 tests19 assertions
Notification-serviceTypeScript buildPassed
Laravel Pint50 filesPassed
Developer route registration28 routesPassed
Postman collectionJSON parsingPassed

Deployment status

These are implementation verification results, not a promise that every environment has completed production deployment. Registration, sandbox simulation, webhook delivery, and an approved live-key workflow should still be smoke-tested after deployment.

Deployment Readiness

  • Publish the shared developer profile type and update the dependent service reference.
  • Build and deploy user-service, then run its database migration.
  • Ensure the user-service queue worker is running for webhook delivery.
  • Deploy notification-service webhook forwarding when it is not already present.
  • Confirm notification-service and user-service share the configured internal service token.
  • Smoke-test new registration, same-email profile attachment, login, sandbox key creation, shipment simulation, and webhook delivery.
  • Approve a test application and smoke-test a live key only after sandbox succeeds.

Behavioral Notes

Environment selection

Sandbox and production use one gateway. sk_test_ and sk_live_ credentials select the environment.

Production submission

The first production MVP supports wallet submission. Other payment methods require separately approved contracts and security work.

Webhook delivery

Retries occur after 30 seconds, 2 minutes, 10 minutes, and 30 minutes. A delivery is failed after five unsuccessful attempts.

Location events

High-frequency GPS or location events are intentionally not forwarded to public developer webhooks.

Deliberately Deferred

The following are outside the current public MVP:

  • Public wallet APIs.
  • Public warehouse APIs.
  • Public driver APIs.
  • Public admin APIs.
  • Card tokenization through the developer API.
  • Published language SDK packages.
  • High-frequency GPS webhooks.
  • Automatic production approval.
  • A standalone developer microservice.

No implied roadmap dates

Deferred capabilities should be documented only after their contracts and security requirements are approved. No availability date is promised here.

Upgrade Guidance

  • Treat the committed OpenAPI file as the authoritative server-to-server contract.
  • Regenerate SDK types and verify operation coverage after a contract change.
  • Test all shipment status transitions in sandbox before production rollout.
  • Validate webhook signatures against the raw body after framework or middleware changes.
  • Rotate credentials and webhook secrets when exposure is suspected.