Shippo
Connect Shippo to rate-shop carriers, buy and refund shipping labels, validate addresses, track packages, handle customs, and run orders, manifests, pickups, and batches.
You end up pasting a single Shippo API token into PopMCP, either shippo_live_… for real postage or shippo_test_… for mock labels.
- Setup time
- 3 min
- Auth
- API credentials
- API base URL
- https://api.goshippo.com
- Rate limits
- Per-endpoint and per-minute, quoted as live / test. Most objects (Address, Parcel, Shipment, Rate, Transaction, Customs, Refund, Manifest, Carrier Account) allow 500 / 50 POST, 4000 / 400 GET single, 50 / 10 GET multiple and 500 / 50 PUT. Batch is 50 / 10 POST and Tracking 750 / 50. Exceeding a limit returns HTTP 429.
Before you begin
- A Shippo account. The free pay-as-you-go tier is enough.
- An account role that can see API Configuration. Shippo hides Developer keys from restricted users.
- A funded Shippo account if you want a live key, because a live token buys real postage.
- A free slot. Shippo allows two active live tokens and two active test tokens per account.
Get your credentials
Sign in to the Shippo API portal
Open portal.goshippo.com/api-config/api and sign in with your Shippo credentials. The app also answers on apps.goshippo.com.
Open API Configuration and Developer keys
In the API Configuration menu select Developer keys. The page splits into Live keys and Test keys.
Developer keys
Tokens that authenticate your calls to the Shippo API.
| Key | Created | Actions |
|---|---|---|
| ••••••••19ba | 29 Nov 2023, 10:42 am GMT | Delete |
| Key | Created | Actions |
|---|---|---|
| ••••••••f853 | 18 Nov 2022, 0:08 pm GMT | Delete |
Live keys allow you to authenticate API requests in your production environment. You can create a maximum of two live keys.
Create the key
Click Create new live key for production, or Create new test key for mock labels.
Developer keys
Tokens that authenticate your calls to the Shippo API.
Once two keys of that type exist the button greys out and the page reads 'A maximum of two tokens have been created.' Delete an old key to free a slot.
Copy the token before closing the dialog
Copy the full token from the dialog, then click Close.
Developer keys
Tokens that authenticate your calls to the Shippo API.
Paste the token into PopMCP
Put the value in PopMCP's API Token field and save. Paste the raw token only, starting with shippo_live_ or shippo_test_.
Connect in PopMCP
Open your workspace, choose Shippo in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| API Tokensecret | In Shippo go to the dashboard → API → API Keys (Developer Keys) and copy a Live or Test token. A test token (shippo_test_…) buys mock labels with no charge; a live token (shippo_live_…) buys real postage. Sent as an Authorization: ShippoToken header, stored encrypted, used server-side only. The connection is locked to this token's account.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Shippo immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the Shippo connector as Connected and a test call such as listing addresses returns JSON instead of "Authentication credentials were not provided."
Troubleshooting
"Authentication credentials were not provided" or 401
Why: The token was pasted with the ShippoToken prefix attached, or it was truncated on copy.
Fix: Paste only the raw token starting with shippo_live_ or shippo_test_. PopMCP adds the ShippoToken prefix itself.
Labels come back as mock labels with no tracking
Why: A test token is connected.
Fix: Create a live key under Developer keys and re-save the connection with the shippo_live_ token.
The token was never copied before the dialog closed
Why: Shippo displays the full key only at creation time and masks it afterwards.
Fix: Delete that key from Developer keys and create a new one, copying it before you click Close.
The create button is greyed out and the page reads "A maximum of two tokens have been created"
Why: The account already holds two active tokens of that type.
Fix: Delete a key you no longer use from the Key list under Developer keys, then create the new one.