Everything the app does,
your code can do too
The Shipping Hub screens are built on the same layer the API exposes. Orders, rates, labels, batches, customers, products, inventory and reports — all reachable with a key.
One key, three ways to send it
API keys are issued per account from the Settings screen. There is no OAuth dance to implement and no session to keep alive — a key is the whole story.
# Bearer token is the recommended form curl -H "Authorization: Bearer $ARUB_KEY" \ "https://ship.arub.com/v1/orders?status=awaiting_shipment&per_page=50"
# Rates first, then buy the one you want curl -H "X-API-Key: $ARUB_KEY" \ "https://ship.arub.com/v1/orders/501311/rates" curl -X POST -H "X-API-Key: $ARUB_KEY" \ -H "Content-Type: application/json" \ -d '{"rate_id":"ups_ground_saver_02"}' \ "https://ship.arub.com/v1/orders/501311/label"
Keys are scoped, not superuser
A key acts as an account, and every request is checked against the same per-feature permissions the web app uses. A key that cannot buy labels in the interface cannot buy them over the API either.
Free plan keys buy USPS labels
Reading orders, quoting rates across every connected carrier, tracking and reports are the same on every plan. Label buying is the one call that follows the plan: a key on a free account can buy USPS labels, and buying UPS or FedEx labels over the API is part of a paid plan. The app is unaffected — any carrier you have connected can still be bought on the order screen on any plan.
A shape you can guess
Collections page and filter the same way, single resources take an id, and actions that change something are POSTs on a named sub-path. A machine-readable description of the whole surface is served from your own instance.
Replace the host with your own instance address. The reference page inside the app documents every parameter and shows a live example response for your account.
Point an AI agent at your warehouse
Arub ships an MCP server in front of the same API, exposing the useful operations as typed tools. Connect it to an assistant and you can ask for the state of the queue, or have it work through exceptions, in words rather than requests.
- Around thirty curated tools covering orders, rates, labels, batches, tracking, customers, products, inventory and reports.
- Two transports. Run it locally over stdio, or host it and pass a key per request.
- Same permissions. The agent is bound by the key it was given, so read-only really is read-only.
{
"mcpServers": {
"arub-ship": {
"command": "php",
"args": ["mcp-stdio.php"],
"env": {
"ARUB_SHIP_KEY": "your-api-key"
}
}
}
}
Ask it things like what is stuck in the queue today or quote order 501311 and tell me the cheapest ground service.
Tracking that arrives instead of being polled
Carrier scan events come in over webhooks and are routed to the right shipment automatically, whether the label was bought on an Arub account or on your own.
Inbound from carriers
USPS, UPS and FedEx events are received, matched to the shipment and reflected on the order without a polling loop.
Your own endpoint
Bring your own carrier account and you get a private hook address of your own, so events land in your instance and nowhere else.
Buyer notifications
Shipment and tracking emails to your buyers are per-instance switches, branded with your logo and edited visually.
Keys, logs and limits
| Item | How it works |
|---|---|
| Issuing keys | Created by an account owner from Settings. Shown once, stored hashed, revocable at any time. |
| Sending a key | Authorization: Bearer, X-API-Key, or an api_key query parameter for tools that cannot set headers. |
| Permissions | A key inherits the granular permission set of the account it belongs to. Read-only keys are a permission choice, not a separate key type. |
| Carriers for label buying | A key on the free plan buys USPS labels. UPS and FedEx label purchases over the API need a paid plan. Rating, tracking and reading are unrestricted on every plan. |
| Request log | Every call is recorded with its endpoint, status and timing, visible in the app so you can see what your integration actually did. |
| Errors | JSON, always. A failure carries the carrier's or marketplace's own message rather than a generic code. |
| Rate limits | No hard cap. Carrier and marketplace quotas still apply upstream and are surfaced rather than hidden. |
| Versioning | The path carries the version. Breaking changes get a new one; additive fields do not. |
| SDK | A PHP client is provided and the MCP server is built on it, so the two never drift apart. |
Build against it
API and MCP access come with Complete, and as an add-on on the other plans. Tell us what you want to automate and we will point you at the right endpoints.