Skip to main content
API settings is where you create API tokens. An API token lets your own systems, or a developer working for you, talk to Zippendo directly: create shipments, read orders, or connect a warehouse or back-office system.

​
Where to find it

Open the organization menu at the bottom of the sidebar, click Manage, then the API settings tab. You see your tokens and an Add API token button. Every plan includes API tokens: Free up to 2, Standard 5, Growth 10, Pro and Enterprise unlimited.

​
Create an API token

1

Open the window

Click Add API token (or Create your first token if the list is empty).
2

Name the token

Enter a Token name *, such as “WMS integration” or “Back office”, so you can recognize it later. You can also set Expires in (days) (up to 365) and, if your organization has brands, Restrict to brand.
3

Pick the permissions

Tick the Permissions * the token needs, for example View shipments and Edit shipments.
4

Create and copy the token

Click Create token. The full token is shown once, in API token created. Click Copy and store it somewhere safe: you can’t see it again after you close the window.
Treat an API token like a password. Don’t share it or put it in code that others can see. If a token gets out, delete it and create a new one.

​
Using the token

Your developer sends the token in the Authorization header of every request: Authorization: Bearer YOUR_TOKEN The address to call and every request are in the API reference. A token only reaches the data of your own organization.

​
Restricting a token to a brand

If your organization uses brands, you can set Restrict to brand when you create a token. Every request made with that token can then only read and write that brand’s data. You can’t change or remove the brand later, so create a new token if you need a different one. A token without a brand works for the whole organization. A developer can still aim a single request at one brand with the X-Zippendo-Brand header, and set a default for list requests with the X-Zippendo-Brand-Scope header (own, shared or both). See Brands and the API reference.

​
Deleting a token

To stop a token from working, for example when an integration is retired or the token was exposed, click Delete on its row in API settings. Type the token’s name in capital letters and confirm. Any system that uses the token stops working at once; create a new token if it should keep running. Every field in detail: Create an API token.