Authentication

Shiprocket's public API uses JWT bearer tokens. You obtain a token by POSTing your account email and password to POST /v1/external/auth/login. The response returns a JSON body with a token field.

POST https://apiv2.shiprocket.in/v1/external/auth/login
Content-Type: application/json

{ "email": "you@seller.com", "password": "••••••••" }

Response:

{ "id": 1234, "first_name": "...", "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9…", "created_at": "..." }

Include the token on every subsequent request as an Authorization: Bearer <token> header. Tokens are long-lived — typically about 10 days. When a token expires, re-call /auth/login to obtain a fresh one. There is no refresh-token endpoint: just re-login. For programmatic integrations, cache the token and refresh only when a 401 response is received.

Always send Content-Type: application/json with request bodies unless the endpoint specifically calls for multipart/form-data (label / manifest / invoice uploads).

Before you authenticate

You need an API user first — see Getting Started for the steps to create one from Settings → API → Add New API User. The password for that user is emailed to your registered account email, not the API user's own address.

The reference's request/response conventions — HTTP methods used, the Authorization: Bearer scheme, and how successful and failed calls are labeled — are covered in Document and API Usage Guidelines.