At a glance
Days remaining until the DPD API authentication token currently used by the Vortex IQ connector will expire. DPD’s web service issues an OAuth-style access token with a fixed lifetime (typically 90 days for the standard merchant API, 30 days for the Predict API surface). When the token expires every label-print, tracking-pull, and shipment-status webhook stops; the connector goes silent. This card is the early-warning siren.
| What it counts | DATEDIFF(token_expiry_at, NOW()) on the active DPD API credential set. Reads expires_at from the OAuth response captured at the last successful refresh, or the explicit tokenExpiry header on each call. |
| API endpoint | DPD’s auth endpoint within the dpd.co.uk API surface (the SOAP-era endpoint and the newer REST endpoint both expose token expiry). The card refreshes its read every 15 minutes. |
| What gets blocked at expiry | Label generation (the dispatch system cannot create new DPD shipments), tracking refreshes (downstream tracking cards go stale), shipment-status webhooks (DPD stops pushing events to the Vortex IQ ingest endpoint), Predict slot-window data (the slot-accuracy card stops updating). |
| Token rotation | DPD allows automated rotation via the refresh-token grant. Most accounts have rotation set up at first connection; some legacy accounts (especially those onboarded before 2023) require manual re-authentication. The card surfaces the gap regardless of rotation status. |
| Service level scope | Per DPD account / sub-account. A merchant with multiple DPD accounts (e.g. one for DPD UK, one for DPD Local) sees one card per credential. |
| Time window | RT (real-time, not period-windowed). |
| Alert trigger | <14 days warn, <3 days critical (driven by the same data, two thresholds on the rendering side). 14 days is enough time for the merchant to either renew or escalate; below 3 days is incident-priority. |
| Currency | n/a. The card surfaces a count of days, no monetary value. |
| Returns / RTO | n/a. |
| Roles | owner, operations |
Calculation
Calculated automatically from your DPD data. See the At a glance summary above for what the metric tracks and the worked example below for a typical reading.Worked example
A UK DTC fashion brand running DPD as the primary delivery carrier (Predict NextDay for high-value parcels, Standard for everything else), one DPD account, automatic refresh-token rotation enabled. Reading taken at 09:00 GMT on 12 Mar 26.| State | Days to expiry | Status | Action |
|---|---|---|---|
| Healthy steady state | 78 | Green | None. Rotation will refresh ~30 days before expiry. |
| Approaching renewal | 18 | Green | None yet. Refresh job will fire at day 14. |
| Refresh failed | 11 | Amber | Investigate refresh log. Run manual refresh. |
| Refresh failed twice | 4 | Red | Incident. Re-authenticate manually before labels stop printing. |
| Expired | -1 | Red (silent) | Connector is silent. Label printing has already stopped. |
- Auto-rotation should fire at day 14, not day 0. Vortex IQ’s connector logic refreshes 14 days before expiry as a buffer. If the reading sits at 14 for more than 24 hours, the refresh has failed and is not retrying. Check the connector logs.
- A failed refresh on day 18 is not yet a crisis but is the moment to act. Refresh failures usually have one of three causes. (a) The DPD account password was changed without updating the connector. (b) DPD rotated their OAuth client secret on their side (rare, but happens during platform migrations). (c) The refresh-token grant was revoked from DPD’s portal (someone manually revoked sessions). Diagnose by attempting a fresh OAuth flow from the connector settings page; if that succeeds, the old refresh token was the issue.
- At <3 days, the playbook is “stop printing labels and re-auth before resuming”. Label printing during the final hours can produce orphan consignments where DPD has the parcel but the dispatch system has no tracking number stored. Cleaning those up after the fact is manual.
- The card does not auto-rotate. It surfaces the gap. Rotation is the connector’s job; the card is the alarm. If rotation is configured and working, this card should never read below ~75 days steady-state.
- DPD Predict tokens are shorter-lived (30 days, not 90). Brands using the Predict slot-window product see this card cycle from 30 to 14 to 30 every two to three weeks; that is normal. Brands using only Standard see a 90-day cycle.
Sibling cards merchants should reference together
Token expiry is an operational-health metric. Pair it with these to monitor connector reliability:| Card | Why pair it with Token Expiry | What the combination tells you |
|---|---|---|
| API Error Rate | A token approaching expiry often produces 401 / 403 responses on edge calls before fully expiring. | A sudden spike in API errors when this card reads <14 days is the rotation about to fail. |
| Label Generation Success | First-line operational impact of a token failure. Labels stop printing immediately on expiry. | If label-generation-success drops while token-expiry is still positive, the issue is upstream of auth. |
| Predict Slot Accuracy | The Predict surface uses a separate, shorter-lived token. | The Predict token can expire while the Standard token is healthy, surfacing as a Predict-specific outage. |
| Shipments Total | A drop to zero new shipments concurrent with a token expiry is the smoke test for connector outage. | Useful for confirming the gap; not a leading indicator. |
Cross-connector: similar token-expiry cards on other connectors (shopify, bigcommerce, royal_mail.roy_auth_token_expiry_days) | Any token expiring is a connector-down event. The merchant’s operations team often watches these as a panel. | A panel of all token cards across connectors is the single-glance health dashboard. |
Reconciling against the vendor’s own dashboard
Where to look in DPD’s own portal: DPD Customer Portal → API Settings → Active Tokens. The portal lists every active OAuth token with its issued-at and expires-at timestamps. The token currently used by Vortex IQ should appear in the list with a label or client-name tag. For accounts using the legacy SOAP credentials, expiry is set on the password rather than a token; DPD enforces a 90-day password rotation. The card surfaces the days-to-rotation in the same way. Why our number may legitimately differ from DPD’s portal:| Reason | Direction | Why |
|---|---|---|
| Cache lag | Ours stale by 15 minutes | The card refreshes the token-state read every 15 minutes. A token refreshed in the last 15 minutes still shows the old expiry. |
| Token revoked but not expired | DPD shows expired, ours shows positive | A merchant or DPD support can revoke a token from the portal before its natural expiry; the revoke is immediate but the expires-at field still shows the original future date. The connector will start failing 401s within minutes; this card’s positive number is misleading. Pair with API Error Rate. |
| Multiple tokens in flight | Either | If a refresh was attempted but failed, the connector may still be using the old token while the portal shows a new failed-issue token. The card reads the active token; reconcile on which token-ID is active. |
| Time zone of expires-at | Boundary days off | DPD’s portal renders timestamps in UK local time (GMT or BST); the card stores in UTC. The “days remaining” calc uses UTC. On the boundary day, the two can differ by 1. |
| Predict vs Standard token | Sees only one | A merchant on both Standard and Predict has two tokens; the card reads whichever is configured as the primary credential. The other can expire silently. |
(token_expiry_days drops to 0) → (api_error_rate spikes 401) → (label_generation_success drops to 0) → (shipments_total → 0 from this minute forward). The four cards form a sequential failure cascade.
Cross-connector reconciliation:
| Card | Expected relationship | Causes of legitimate divergence |
|---|---|---|
| Token-expiry cards on other connectors | Independent. Each connector has its own auth credential. | One connector’s token expiry tells you nothing about another’s. |
Documentation cross-reference (across connectors with API-token auth). Auth-token-expiry cards exist on every connector that uses a finite-lifetime credential. The card’s behaviour is the same on all of them.
royal_mail.roy_auth_token_expiry_dayshermes_evri.her_auth_token_expiry_daysapc.apc_auth_token_expiry_days