Connectez votre propre boutique à Shiplayer.

Base URL     https://shiplayer.online
Content-Type application/json
Authorization: Bearer shp_live_xxxxxxxxxxxxxxxxxxxxxxxx

# Vérifiez la clé : votre compte marchand
curl https://shiplayer.online/merchants/me \
  -H "Authorization: Bearer $SHIPLAYER_KEY"

curl -X POST https://shiplayer.online/orders/CMD-10482/quotes \
  -H "Authorization: Bearer $SHIPLAYER_KEY"

200 OK
{
  "recommended": { "carrier_code": "relaisexpress", "price_mad": "30.00", ... },
  "candidates": [
    { "carrier_code": "relaisexpress", "price_mad": "30.00",
      "expected_landed_cost_mad": "48.10", "promised_transit_hours": 48,
      "rate_basis": "contract", "insurance_offer_fee_mad": "6.75", ... },
    { "carrier_code": "sendit", "price_mad": "45.00", ... }
  ],
  "not_offered": [
    { "carrier_code": "digylog", "reason": "Digylog n'accepte pas les colis de moins de 1.2 kg." }
  ]
}

# L'étiquette (PDF)
curl https://shiplayer.online/shipments/SHP8B064DE84C28/label.pdf \
  -H "Authorization: Bearer $SHIPLAYER_KEY" -o etiquette.pdf

# Plusieurs étiquettes en un PDF
curl "https://shiplayer.online/labels.pdf?ref=SHP8B064DE84C28&ref=SHP2F19C0A7E415" \
  -H "Authorization: Bearer $SHIPLAYER_KEY" -o etiquettes.pdf

# Annuler avant ramassage
curl -X POST https://shiplayer.online/shipments/SHP8B064DE84C28/cancel \
  -H "Authorization: Bearer $SHIPLAYER_KEY"

POST https://ma-boutique.ma/webhooks/shiplayer
Content-Type: application/json
User-Agent: Shiplayer-Webhooks/1.0
Shiplayer-Event: shipment.updated
Shiplayer-Delivery: whd_3f9c2a7b1e4d5a6c8b0f
Shiplayer-Signature: t=1760364004,v1=5c1a0f…e2b9

{
  "id": "whd_3f9c2a7b1e4d5a6c8b0f",
  "event": "shipment.updated",
  "created_at": "2026-10-16T11:02:04Z",
  "merchant_id": "mrc_atlas",
  "data": {
    "shiplayer_ref": "SHP8B064DE84C28",
    "order_id": "CMD-10482",
    "status": "delivered",
    "tracking_url": "https://shiplayer.online/t/SHP8B064DE84C28",
    "legs": [ ... ], "events": [ ... ], "pod": { ... },
    ...
  }
}

Vérifier la signature

import hmac, hashlib, time

def verify(secret: str, header: str, body: bytes) -> bool:
    fields = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = int(fields["t"]), fields["v1"]
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

# Flask
@app.post("/webhooks/shiplayer")
def shiplayer():
    if not verify(SECRET, request.headers["Shiplayer-Signature"], request.get_data()):
        abort(401)
    msg = request.get_json()
    if msg["event"] == "shipment.updated":
        update_order(msg["data"]["order_id"], msg["data"]["status"], msg["data"]["tracking_url"])
    return "", 200

function shiplayer_verify(string $secret, string $header, string $body): bool {
    parse_str(str_replace(',', '&', $header), $f);
    if (!isset($f['t'], $f['v1']) || abs(time() - (int)$f['t']) > 300) return false;
    $expected = hash_hmac('sha256', $f['t'] . '.' . $body, $secret);
    return hash_equals($expected, $f['v1']);
}

$body = file_get_contents('php://input');
if (!shiplayer_verify(SECRET, $_SERVER['HTTP_SHIPLAYER_SIGNATURE'] ?? '', $body)) {
    http_response_code(401); exit;
}
$msg = json_decode($body, true);
if ($msg['event'] === 'shipment.updated') {
    update_order($msg['data']['order_id'], $msg['data']['status'], $msg['data']['tracking_url']);
}
http_response_code(200);

const crypto = require("crypto");

function verify(secret, header, rawBody) {
  const f = Object.fromEntries(header.split(",").map(p => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(f.t)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${f.t}.`).update(rawBody).digest("hex");
  return expected.length === f.v1.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(f.v1));
}

// Express — gardez le corps brut : express.raw(), pas express.json()
app.post("/webhooks/shiplayer", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(SECRET, req.get("Shiplayer-Signature") || "", req.body)) return res.sendStatus(401);
  const msg = JSON.parse(req.body);
  if (msg.event === "shipment.updated") updateOrder(msg.data.order_id, msg.data.status, msg.data.tracking_url);
  res.sendStatus(200);
});

Fiabilité