Authentication

The ShipOS v2 API authenticates callers with API client credentials — a X-Client-Id and a X-Client-Secret — sent as HTTP headers on every request to an authenticated endpoint. Only GET /ping is public; every other endpoint, tracking included, needs credentials.

How it works

Send both credential headers, plus Accept: application/json, on every authenticated request:

Header	Required	Description
X-Client-Id	yes	The account's public client identifier.
X-Client-Secret	yes	The account's secret. Compared server-side in constant time (hash_equals).
Accept	recommended	Always send application/json.

The X-Client-Id resolves the merchant account (a User). The account is then attached to the request for the endpoint to act under. There is no token exchange or session — every request carries the credentials directly.

Where credentials come from

Credentials are per merchant account. They are generated and regenerated by a ShipOS administrator from the customer edit page in the ShipOS admin panel. There is no v2 API endpoint to create, rotate, or retrieve credentials — that is an admin-panel operation only.

Failure cases

Both errors use the unauthenticated code and HTTP 401, wrapped in the standard error envelope:

Condition	Status	code	message
Either header missing	401	unauthenticated	Missing API credentials. Send X-Client-Id and X-Client-Secret.
Unknown X-Client-Id, or wrong X-Client-Secret	401	unauthenticated	Invalid API client credentials.

{
  "error": {
    "code": "unauthenticated",
    "message": "Invalid API client credentials.",
    "status": 401
  }
}

Worked example

Fetch the calling account with GET /account:

cURL

curl --location 'https://app.shipos.co.il/api/v2/account' \
--header 'X-Client-Id: {client_id}' \
--header 'X-Client-Secret: {client_secret}' \
--header 'Accept: application/json'

JavaScript

// Node.js 18+ / browsers — no dependencies
const response = await fetch('https://app.shipos.co.il/api/v2/account', {
  headers: {
    'X-Client-Id': process.env.SHIPOS_CLIENT_ID,
    'X-Client-Secret': process.env.SHIPOS_CLIENT_SECRET,
    Accept: 'application/json',
  },
})

if (!response.ok) {
  const { error } = await response.json()
  throw new Error(`${error.code}: ${error.message}`) // unauthenticated on 401
}

const { data: account } = await response.json()

console.log('Authenticated as', account.company_name)

PHP

<?php
// composer require guzzlehttp/guzzle

$client = new \GuzzleHttp\Client();

$response = $client->get('https://app.shipos.co.il/api/v2/account', [
    'headers' => [
        'X-Client-Id' => getenv('SHIPOS_CLIENT_ID'),
        'X-Client-Secret' => getenv('SHIPOS_CLIENT_SECRET'),
        'Accept' => 'application/json',
    ],
]);

$account = json_decode($response->getBody()->getContents(), true)['data'];

echo 'Authenticated as ', $account['company_name'], PHP_EOL;

Laravel

<?php

use Illuminate\Support\Facades\Http;

$account = Http::withHeaders([
    'X-Client-Id' => config('services.shipos.client_id'),
    'X-Client-Secret' => config('services.shipos.client_secret'),
])
    ->acceptJson()
    ->get('https://app.shipos.co.il/api/v2/account')
    ->throw()
    ->json('data');

logger()->info('Authenticated as '.$account['company_name']);

Python

# pip install httpx
import os

import httpx

response = httpx.get(
    "https://app.shipos.co.il/api/v2/account",
    headers={
        "X-Client-Id": os.environ["SHIPOS_CLIENT_ID"],
        "X-Client-Secret": os.environ["SHIPOS_CLIENT_SECRET"],
        "Accept": "application/json",
    },
)
response.raise_for_status()  # raises on 401 unauthenticated

print("Authenticated as", response.json()["data"]["company_name"])

Go

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://app.shipos.co.il/api/v2/account", nil)
	req.Header.Set("X-Client-Id", os.Getenv("SHIPOS_CLIENT_ID"))
	req.Header.Set("X-Client-Secret", os.Getenv("SHIPOS_CLIENT_SECRET"))
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	if res.StatusCode != http.StatusOK {
		panic(fmt.Sprintf("ShipOS error: HTTP %d", res.StatusCode))
	}

	var payload struct {
		Data struct {
			CompanyName string `json:"company_name"`
		} `json:"data"`
	}
	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
		panic(err)
	}

	fmt.Println("Authenticated as", payload.Data.CompanyName)
}

Java

// Java 17+ — java.net.http, no dependencies
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class ShipOsCredentialCheck {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://app.shipos.co.il/api/v2/account"))
            .header("X-Client-Id", System.getenv("SHIPOS_CLIENT_ID"))
            .header("X-Client-Secret", System.getenv("SHIPOS_CLIENT_SECRET"))
            .header("Accept", "application/json")
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        if (response.statusCode() != 200) {
            throw new RuntimeException("ShipOS error: " + response.body());
        }

        System.out.println(response.body()); // {"data":{...}}
    }
}

C#

// .NET 8+ — System.Net.Http.Json
using System.Net.Http.Json;
using System.Text.Json;

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("X-Client-Id",
    Environment.GetEnvironmentVariable("SHIPOS_CLIENT_ID"));
http.DefaultRequestHeaders.Add("X-Client-Secret",
    Environment.GetEnvironmentVariable("SHIPOS_CLIENT_SECRET"));
http.DefaultRequestHeaders.Add("Accept", "application/json");

var payload = await http.GetFromJsonAsync<JsonDocument>(
        "https://app.shipos.co.il/api/v2/account")
    ?? throw new InvalidOperationException("Empty response");

var account = payload.RootElement.GetProperty("data");

Console.WriteLine($"Authenticated as {account.GetProperty("company_name").GetString()}");

Ruby

require "net/http"
require "json"

uri = URI("https://app.shipos.co.il/api/v2/account")
request = Net::HTTP::Get.new(uri)
request["X-Client-Id"] = ENV.fetch("SHIPOS_CLIENT_ID")
request["X-Client-Secret"] = ENV.fetch("SHIPOS_CLIENT_SECRET")
request["Accept"] = "application/json"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

raise "ShipOS error: #{response.body}" unless response.is_a?(Net::HTTPSuccess)

account = JSON.parse(response.body).fetch("data")

puts "Authenticated as #{account["company_name"]}"

Rust

// [dependencies]
// reqwest = { version = "0.12", features = ["json"] }
// tokio = { version = "1", features = ["full"] }
// serde_json = "1"
use serde_json::Value;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let payload: Value = reqwest::Client::new()
        .get("https://app.shipos.co.il/api/v2/account")
        .header("X-Client-Id", std::env::var("SHIPOS_CLIENT_ID")?)
        .header("X-Client-Secret", std::env::var("SHIPOS_CLIENT_SECRET")?)
        .header("Accept", "application/json")
        .send()
        .await?
        .error_for_status()?
        .json()
        .await?;

    println!("Authenticated as {}", payload["data"]["company_name"]);
    Ok(())
}

A successful call returns the merchant account wrapped in { "data": { ... } }. See GET /account for the full response shape.