Skip to content

Shippo API Token

Service Name: Shippo

Service Description: Shippo is a shipping API platform that connects businesses to multiple shipping carriers through a single integration, allowing them to compare rates, print labels, track packages, and automate shipping processes.

Service Address: https://goshippo.com/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants programmatic access to Shippo's shipping API, allowing users to create shipping labels, track packages, validate addresses, and manage shipping operations.

Secret Revokement URL: https://apps.goshippo.com/login?next=/settings/api

Secret Example: shippo_live_9d8e7f6c5b4a3210fedcba9876543210

Suspicious Activity Investigation Instructions:

  • Review Shippo dashboard for unusual shipping label creation or address validation activities
  • Check for unexpected shipping labels or packages being created through the API
  • Monitor for API calls from unfamiliar IP addresses or locations
  • Review transaction history for unauthorized shipping activities
  • Check for changes in shipping destinations or unusual shipping patterns

Mitigation Instructions:

  • Log in to your Shippo account at https://apps.goshippo.com/login

  • Navigate to Settings > API section

  • Click on "Reset API Token" to invalidate the current token

  • Generate a new API token to replace the compromised one
  • Update the API token in all legitimate applications and services
  • Review and update API access permissions if necessary
  • Enable additional security measures like IP restrictions if available
  • Monitor API usage for a period after token replacement to ensure security