Skip to main content
Metrics type: Key Metrics • Category: Shipping & Courier

​
At a glance

Days until your ShippyPro API auth token expires. When the token expires, every label-print, rate-shop, and tracking call fails immediately, breaking despatch end-to-end until a human re-authenticates. This is the most operational of the operational-health cards: a silent ticking clock that turns into a P1 incident the moment it hits zero.

​
Calculation

Calculated automatically from your ShippyPro data. See the At a glance summary above for what the metric tracks and the worked example below for a typical reading.

​
Worked example

The Italian DTC fashion brand. Reading taken at 09:00 CET on 12 Mar 26. The card reads 2 days for the primary workspace; the alert at <14 days has been firing for 12 days already. Five things to notice:
  1. The clock has been counting down for 363 days; nobody noticed for 351 of them. This is the failure mode of token-expiry: silent until it isn’t. The 14-day alert is meant to guarantee humans notice with two weeks of cushion. If the alert was acknowledged but the rotation work was deprioritised, escalate now.
  2. Two days is a P1 weekend risk. If the token expires at 14 Mar 26 03:00 CET (the original issue timestamp), Saturday morning despatch breaks. Operations on Monday will find unprocessable orders backlog from Sunday plus Saturday overflow. The fix window before P1 is the next business day; rotate today.
  3. The fr workspace is healthy and is the rollback path. If the it rotation goes wrong, the fr token can technically print labels for it shipments via a workspace switch, with manual rate-card and template overrides. Document the rollback path before rotating.
  4. Re-auth requires a human in ShippyPro’s UI. The OAuth flow needs an admin user to log into ShippyPro Settings → API & Integrations → Generate New Token, copy the new bearer, paste into the Vortex IQ connector settings. Coordinate the rotation with despatch downtime (typically <5 minutes if pre-staged).
  5. After rotation, the card resets to 365 days (or whatever the issue-time window is). Re-read the card 24 hours after rotation to confirm the new expiry has propagated; if the card still shows <14 days the new token did not save correctly. Record the rotation in the change-history block of the workspace.

​
Sibling cards merchants should reference together

Token-expiry is binary at the day level (alert fires or not), but it is a leading indicator for a chain of operational cards. Pair with these to anticipate impact:

​
Reconciling against the vendor’s own dashboard

Where to look in ShippyPro’s own dashboard: ShippyPro Settings → API & Integrations. The page lists the active token, issue date, expiry date, and a “Rotate” button. The card and the portal read the same source; numbers should match exactly. If they differ by more than a few minutes, the connector poll cycle is stale and a manual reconnect refreshes the read. Why our number may legitimately differ from ShippyPro’s portal: Cross-connector reconciliation:

​
Known limitations / merchant FAQs

Why does ShippyPro use expiring tokens at all? Other connectors use long-lived API keys. Security policy. ShippyPro’s OAuth model rotates the bearer to limit exposure if a token leaks. Most workspaces are issued 365-day tokens; enterprise accounts can request 180 or 90-day windows. The trade-off is operational: shorter windows mean more rotation work but smaller credential-exposure blast radius. The token expired and despatch is broken. What is the recovery time? Rotation itself takes 5 to 10 minutes if you have ShippyPro admin access ready. After re-saving in Vortex IQ, the connector resumes API calls within one poll cycle (5 to 15 minutes). The backlog of unprocessed orders since expiry then needs to be re-queued; tools like Vortex IQ’s connector-resync command handle this. Total restoration typically 30 minutes; longer if you need to wait for an admin user. Can I rotate proactively before expiry? Yes, recommended. ShippyPro lets you generate a new token before the old one expires; both are valid simultaneously for a few hours of grace. Rotate at the 30-day mark on a calendared cadence, not in firefighting mode. The card will reset to 365 days post-rotation. Why does the alert fire at 14 days specifically? The 14-day threshold is conventional across cloud-platform secret rotation. Two business weeks is enough cushion for change-management approval, off-hours rotation scheduling, and rollback if the new token has issues. Below 7 days the alert escalates to P2; below 2 days it should be P1. Multi-workspace merchants, does each token need separate rotation? Yes, each ShippyPro workspace has its own token; each must be rotated independently. The card surfaces them as separate workspace entries (if the connector is configured per workspace). Build a rotation calendar that staggers them so you never have two workspaces expiring in the same week. What happens to in-flight shipments when the token expires? Already-printed labels continue tracking via carrier webhooks (the carrier posts to ShippyPro directly, not through your connector). The visible breakage is on new shipments: cannot rate-shop, cannot print labels, cannot file claims. Existing-claim status updates may also lag. Why is this card hero-tier and not standard? Because token expiry is the single failure mode that takes despatch from “running” to “broken” in zero time. Other operational-health cards (API error rate, label generation success) trend gradually; expiry is binary at zero. Can I automate token rotation? Partially. ShippyPro’s API supports programmatic token issuance once an admin has authorised the OAuth client. A workspace can run a quarterly rotation script that issues a new token, posts it to Vortex IQ via API, and revokes the old one. This reduces the human-in-loop window but the OAuth handshake still requires periodic re-authorisation (typically annually). My token says “never expires” but the card shows a number. Why? Some legacy ShippyPro accounts have non-expiring API keys. The connector falls back to a synthetic 365-day expiry from the issue date for display; this is a placeholder and will not actually expire. Set the alert to “ignore” for these accounts to suppress false alerts.

​
Tracked live in Vortex IQ Nerve Centre

Days to Token Expiry is one of hundreds of KPI pulses Vortex IQ tracks across ShippyPro and 70+ other ecommerce connectors. Nerve Centre runs the detection layer; Vortex Mind investigates the cause when something moves; Ask Viq lets you interrogate any number in plain English. Start for free or book a demo to see this metric running on your own data.