Skip to content

Shippo API Key

Service Name: Shippo

Service Description: Shippo is a shipping API platform that connects businesses to multiple shipping carriers through a single integration, allowing them to compare rates, print labels, track packages, and automate shipping processes.

Service Address: https://goshippo.com/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to Shippo's shipping API, allowing users to create shipping labels, track packages, validate addresses, and manage shipping operations.

Secret Revokement URL: https://goshippo.com/docs/api/#authentication

Secret Example: shippo_test_cf1b6d0655e59fc6316492b5db8fa9216c8a2f99

Suspicious Activity Investigation Instructions:

  • Review Shippo dashboard for unusual shipping activity or unauthorized label creation.
  • Check API logs for unexpected API calls or access from unfamiliar IP addresses.
  • Monitor for unusual shipping patterns, destinations, or volume increases.
  • Verify if there are any unexpected changes to shipping configurations or carrier accounts.
  • Review billing statements for unexpected charges related to shipping labels.

Mitigation Instructions:

  • Log in to your Shippo account dashboard.

  • Navigate to API section or Settings.

  • Locate the compromised API key.

  • Generate a new API key to replace the compromised one.
  • Revoke/delete the compromised API key.
  • Update all applications and services using the old API key with the new one.
  • Review and update API access permissions if necessary.
  • Enable additional security measures like IP restrictions if available.
  • Monitor for any continued unauthorized activity.