Agentic Fabriq
ShipEngine
BUSINESS · COMMERCE & FINANCE
Rates, labels, tracking, and address validation on that account’s own key.
Connect ShipEngine with Fabriq Developer
Your user pastes their ShipEngine credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting ShipEngine in practice
ShipEngine API keys carry no scopes — the docs say every key of a type has access to all the same data as other keys of that type, and the only visible difference is the TEST_ prefix on a sandbox key — so containment is rotation, not permissioning. The default ceiling is 200 requests a minute and the sandbox is 20, low enough that the docs recommend mocking rather than letting a test suite call the real API.
Scopes that draw scrutiny
API-Key (production)Full access to everything the API can do, including buying labels, which means real money. You can create as many as you like, but none of them can be narrowed.API-Key (sandbox, TEST_ prefix)Same reach against the sandbox. The prefix is the only signal in the credential itself that a caller is not about to spend money.
Rate limits
- Default: 200 requests per minute per account. Higher limits are a support request rather than a plan upgrade.
- Sandbox environment: 20 requests per minute, and lower limits than production on some endpoints.
- 429 responses carry a Retry-After header giving the number of seconds to wait.
- Carriers, insurance providers and marketplaces impose their own limits, which surface through the same errors — the error_source field says whether the limit was ShipEngine’s or a third party’s.
Worth knowing
- Rate limits apply account-wide, so retry logic belongs at a global level; per-call backoff makes every concurrent caller retry at the same moment and get limited again.
- The documented fix for bulk work is the bulk endpoints — batch label creation, rates for multiple shipments, multi-address validation, multiple shipment creation, order import — which do hundreds of operations in one request.
- TLS 1.0 and every version of SSL are unsupported, so older runtimes fail at the handshake rather than at authentication.
- The API key must never reach a browser or mobile client: there is no public or client-side key type, and the docs point out that CORS blocks the direct call anyway.
- The documentation now reads as "ShipStation API" throughout while the host stays api.shipengine.com, so product names in the docs and in your code will not match.
Checked against Usage and rate limits (2026-09-29), Authentication (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put ShipEngine behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.