Shippo Authentication: API Key Setup & Security (2026)

Authentication overview

Shippo's API utilizes API tokens (often referred to as API keys) for authenticating requests. This method ensures that all interactions with the Shippo platform are authorized and secure. API tokens are unique strings that identify your application or user account, granting programmatic access to Shippo's services, such as creating shipping labels, tracking packages, and managing returns. All communication with the Shippo API must occur over HTTPS, encrypting data in transit and protecting sensitive information.

The use of API tokens aligns with common industry practices for RESTful API authentication, offering a straightforward yet secure mechanism for developers. By including the API token in the request header, clients can prove their identity without needing to store or transmit user credentials directly with each API call. This approach contributes to a robust security posture, especially when combined with secure storage and management practices for the tokens themselves, such as using environment variables or dedicated secret management services.

Supported authentication methods

Shippo primarily supports API token-based authentication for its RESTful API. This method is suitable for server-to-server communication and client applications where the API token can be securely stored and managed. Shippo provides different types of API tokens, each with specific access levels to support various development and production workflows.

API token types

• Test API Token: Used for development and testing environments. Requests made with this token interact with Shippo's sandbox environment, allowing developers to test integrations without incurring real shipping costs or creating live labels.
• Live API Token: Used for production environments. Requests made with this token create real shipping labels and interact with live carrier systems. This token should be treated with the highest level of security.
• Read-only API Token: Provides limited access, allowing only retrieval of data (e.g., tracking information or previous label details) without the ability to create or modify resources. This is useful for applications that only need to display information without performing transactional operations.

For more details on the specific API endpoints and their required authentication, refer to the official Shippo API reference.

Getting your credentials

To obtain your Shippo API tokens, you need to access your Shippo dashboard. The process involves generating these tokens within your account settings, which can then be used in your application to authenticate API requests.

1. Log in to your Shippo Account: Navigate to the Shippo website and log in with your credentials.
2. Access API Settings: Once logged in, go to the "API" section or "Settings" > "API" within your dashboard. The exact navigation may vary slightly but will typically be found under developer or account settings.
3. Generate Tokens: In the API section, you will find options to generate or view your Test and Live API tokens. You may also have the option to generate a Read-only token. Shippo typically displays the Live token only once upon generation, so it is crucial to copy and store it securely immediately.
4. Copy and Store Securely: Copy the generated API token(s). It is strongly recommended to store these tokens in a secure manner, such as environment variables, a secrets management service, or a secure configuration file, rather than hardcoding them directly into your application's source code.

Shippo's documentation provides a detailed guide on how to manage your API keys within the dashboard. Remember to treat your Live API token with the same care as a password, as it grants full access to your Shippo account's transactional capabilities.

Authenticated request example

When making API requests to Shippo, your API token must be included in the Authorization header of your HTTP request. The standard format is Authorization: ShippoToken <YOUR_API_TOKEN>.

Here's an example using Python's requests library to retrieve a list of carriers:

import requests
import os

# It is recommended to store your API token in an environment variable
# For example: export SHIPPO_API_TOKEN="shippo_test_12345..."
SHIPPO_API_TOKEN = os.environ.get("SHIPPO_API_TOKEN")

if not SHIPPO_API_TOKEN:
    raise ValueError("Shippo API token not found in environment variables.")

url = "https://api.goshippo.com/carriers/"

headers = {
    "Authorization": f"ShippoToken {SHIPPO_API_TOKEN}",
    "Content-Type": "application/json"
}

try:
    response = requests.get(url, headers=headers)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    carriers = response.json()
    print("Successfully retrieved carriers:")
    for carrier in carriers['results']:
        print(f"- {carrier['carrier_name']} (Token: {carrier['carrier_token']})")
except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err} - {response.text}")
except Exception as err:
    print(f"An error occurred: {err}")

This example demonstrates how to set the Authorization header correctly. The API token is retrieved from an environment variable, which is a common security practice. Shippo also provides official SDKs for various programming languages (Python, Ruby, Node.js, PHP, Java, Go, C#) that abstract away the HTTP request details and simplify authentication.

Security best practices

Securing your Shippo API tokens is paramount to protect your account and prevent unauthorized shipping activities. Adhering to these best practices will help maintain the integrity and confidentiality of your integration.

1. Protect your API tokens

• Never hardcode API tokens: Do not embed your Live API token directly into your source code. This makes it vulnerable if your code repository is compromised.
• Use environment variables: Store API tokens as environment variables on your server or development machine. This keeps them out of your codebase and allows for easy rotation.
• Utilize secret management services: For production environments, consider using dedicated secret management services like AWS Secrets Manager, Google Cloud Secret Manager, or Azure Key Vault. These services provide secure storage, versioning, and access control for sensitive credentials.
• Restrict access: Limit who has access to your production API tokens. Only authorized personnel should be able to retrieve or modify them.

2. Transmit tokens securely

• Always use HTTPS: Ensure all API requests to Shippo are made over HTTPS (HTTP Secure). This encrypts the communication channel, protecting your API token and other sensitive data from eavesdropping during transit. The IETF RFC 2818 specifies HTTP over TLS, which is the underlying protocol for HTTPS.
• Avoid URL parameters: Never pass API tokens in URL query parameters, as these can be logged by servers, proxies, and browser histories.

3. Implement least privilege

• Use appropriate token types: Use Test tokens for development and Read-only tokens for applications that only need to retrieve data. Only use Live tokens for production processes that require creating or modifying resources.
• Rotate tokens regularly: Periodically generate new API tokens and revoke old ones. This minimizes the impact of a compromised token.

4. Monitor and log access

• Audit logs: Regularly review any available audit logs in your Shippo account or your application's logs to detect unusual API activity.
• Error handling: Implement robust error handling in your application to catch and log authentication failures, which could indicate misuse or attempted unauthorized access.

5. Secure your development environment

• Local environment security: Ensure your local development environment is secure, with strong passwords and up-to-date security patches.
• Version control best practices: Configure your version control system (e.g., Git) to ignore files that might contain API tokens (e.g., .env files) using a .gitignore file.

By implementing these security measures, developers can significantly reduce the risk of unauthorized access and maintain a secure integration with the Shippo API. For general API security principles, the Mozilla Developer Network's guide on HTTP authentication provides a good overview of common practices.