Upcoming Public API changes: user permissions and token generation
We’re making two changes to ShipHero’s Public API. Rollout dates are still pending, but you should review and update your integration users’ permissions now to prepare.
1. Tokens will respect user permissions - prepare now
API tokens will be limited to the permissions of the ShipHero user they belong to. This applies to tokens already in use.
If an integration performs actions its user isn’t permitted to perform in ShipHero, those calls will fail once this change takes effect - even if the token is still valid.
Please make the necessary permission changes now to avoid interruptions when this rolls out:
-
Identify the user associated with each integration’s token.
-
Review the actions the integration performs.
-
Grant that user the required permissions under Users & Roles.
Alternatively, create a dedicated user with the right permissions now, then generate a token for it when token generation in the app becomes available.
Developer users have full permissions and are not affected by this permission change.
2. Generate tokens directly in ShipHero
We’ll retire /auth/token, the endpoint that exchanges a username and password for access and refresh tokens. Before that happens, you’ll be able to generate those tokens directly in the ShipHero web UI.
Retiring this endpoint will not invalidate tokens you already have. The /auth/refresh endpoint is not changing, so you can continue using your refresh token to renew access tokens.
If your integration creates new tokens with a username and password, you’ll need to update that step once token generation in the app is available.
Instructions for generating tokens in the app are will be shared here when available.