How to Create a Developer User for API Access

Welcome to Mountainy! Our platform is powered by the robust ShipHero system, giving you access to a comprehensive GraphQL Public API for custom integrations. To interact with the API securely, you must generate an Access Token and a Refresh Token. The safest and most recommended method is to create a dedicated Third-Party Developer User within your Shiphero account.

This guide will walk you through the process of creating a developer user, obtaining your API tokens, and understanding essential security considerations for your integrations.

IMPORTANT NOTE: You must have App.Shiphero.com user permissions allowed. If you are unsure if you have this enabled please reach out to the Mountainy team in slack.

Why Create a Third-Party Developer User?

When building custom integrations or working with external developers, sharing your primary account credentials (username and password) is neither ideal nor secure. By creating a Third-Party Developer User, you can provide developers with the necessary Bearer Token and Refresh Token without exposing your personal login information .

Furthermore, to minimize account-related complications, we strongly recommend creating a dedicated developer user for each unique third-party integration you implement .

Step-by-Step Guide to Adding a Developer User

Adding a third-party developer to your account is a straightforward process. Please ensure that the email address you use for the developer user is unique, as the same email cannot be used across multiple users in the platform .

1. Log in to your Mountainy account and navigate to the My Account > Developer Users page. You can access this directly at https://app.shiphero.com/dashboard/users .

2. Click on the Add a 3rd Party Developer button located on the top right side of the page .

3. Enter the required Developer Details, which include the First Name, Last Name, and a unique Email address. Once filled out, click Add Developer .

4. Upon successful creation of the user, the system will generate and display an API Access Token and a Refresh Token.

Important Security Notice: Be sure to copy the Access Token immediately and store it securely. This token will only be displayed once. If you lose it, you will need to use the Refresh Token to generate a new Access Token . Always communicate these secrets to your developers in a secure manner .

Understanding Your API Tokens

Once you have generated your tokens, it is crucial to understand how they function and their respective lifecycles to maintain uninterrupted access to the API.

The Refresh Token remains active as long as the associated Mountainy account is active. However, if an account becomes canceled, suspended, or inactive, any generated tokens will cease to function, even if the token generation process initially appeared successful .

Keep in mind that refresh tokens should be kept in a safe place, as they allow anyone in possession of them to generate access tokens that grant access to your data .

Making Your First API Request

Mountainy's public API operates on GraphQL and is accessible at https://public-api.shiphero.com/graphql. Every request made to this endpoint must include your Access Token in the header to validate your identity .

The required header format is:

Authorization: Bearer <your access token>

When your Access Token expires after 28 days, your developer can programmatically generate a new one by sending a POST request with the Refresh Token to the authentication endpoint at https://public-api.shiphero.com/auth/refresh .

For exploring the schema and testing queries, we recommend using desktop versions or extensions of Client IDEs such as GraphQL Playground, Altair GraphQL Client, or Insomnia App .

References

[1] ShipHero Developer Resources: Getting Started

[2] ShipHero Software Support: How to Obtain API Access & Refresh Tokens