Revoking ShipHero API access stops an API token from working in your account. Use it when a token is exposed, an integration is retired, or someone who had a token leaves your team. The steps depend on how the token was created.
Before You Begin
- Token type: Find out how the token was created. ShipHero has three kinds of API tokens: developer user tokens, scoped OAuth tokens, and regular user tokens. See ShipHero API Token Types and How to Revoke Them.
- Integration downtime: Anything that uses the token stops working as soon as you revoke it. Create a replacement token when the integration or agent needs to keep working.
To create tokens, see How to Obtain API Access and Refresh Tokens and How to Give a ShipHero User API Access. To connect an AI assistant, see Overview: ShipHero AI Toolkit.
Table of Contents
- ShipHero API Token Types and How to Revoke Them
- How to Revoke ShipHero Developer User Tokens
- How to Revoke ShipHero Scoped OAuth Tokens
- How to Revoke ShipHero Regular User Tokens
- Need Help Revoking ShipHero API Access?
ShipHero API Token Types and How to Revoke Them
ShipHero issues API tokens in three ways. The way a token was created decides how you revoke it.
| Token type | How it was created | How to revoke it |
|---|---|---|
| Developer user tokens | Generated when you add a third-party developer on the Developer Users page. | Select De-activate for the developer user. |
| Scoped OAuth tokens | Created when an AI agent connects to ShipHero through the ShipHero MCP or the ShipHero Public API Skill. | Ask the agent to revoke the token, or send a POST request to the ShipHero revoke endpoint. |
| Regular user tokens | Used by a regular ShipHero user who has API access turned on. | Select Sign out and revoke tokens for the user, clear Enable API Access on the user, or deactivate the user. |
How to Revoke ShipHero Developer User Tokens
Deactivating a developer user stops both its API Access Token and its Refresh Token from working. Use this method for any third-party integration that has its own developer user.
- Go to the My Account > Developer Users page.
- Find the developer user your integration uses.
- Select De-activate in the Actions column for that developer user.
- To keep the integration running, select Add Third-Party Developer and create a new developer user. Copy the new API Access Token and Refresh Token and add them to your integration. See How to Obtain API Access and Refresh Tokens.
Developer Users Cannot Be Reactivated
You cannot reactivate a developer user after you deactivate it. Create a new developer user to get new tokens.
How to Revoke ShipHero Scoped OAuth Tokens
Scoped OAuth tokens belong to the AI agent that connected to ShipHero. You can revoke them by asking the agent, or by sending a request to the ShipHero revoke endpoint.
Revoke ShipHero Scoped OAuth Tokens by Asking Your Agent
Ask the agent that created the token to revoke it. This works in Claude Code, Claude Desktop, and opencode.
- Open the AI agent you used to connect to ShipHero.
- Ask the agent to revoke its ShipHero token or remove the ShipHero connection.
- To connect again, follow the setup steps in Overview: ShipHero AI Toolkit.
Your AI client manages the ShipHero connection, so the steps vary by client. Most clients also have their own command for managing connections, such as /mcp.
Revoke ShipHero Scoped OAuth Tokens With the Revoke Endpoint
Send a POST request with the token to https://login.shiphero.com/oauth/revoke. For the request format, see Revoke Access in the ShipHero developer documentation. After you revoke the token, request a new token if the integration needs to keep working.
How to Revoke ShipHero Regular User Tokens
Regular user tokens stop working when you revoke them, clear Enable API Access on the user, or deactivate the user. All three methods use the Users & Roles page.
Revoke ShipHero Regular User Tokens with Sign Out and Revoke Tokens
Sign out and revoke tokens invalidates the user's current API tokens and signs the user out of ShipHero automatically. The user stays active and can sign in again and generate new tokens. Only admins can revoke tokens, and you can revoke tokens for one user at a time.
- Go to the Users & Roles page.
- Check the user whose tokens you want to revoke.
- Select Sign out and revoke tokens above the users list.
- In the Sign out and revoke tokens window, check the user's name and select Sign out and revoke tokens. The message "Tokens revoked" confirms it worked.
| Confirm in the Sign out and revoke tokens window | Tokens revoked message |
|---|---|
Revoke ShipHero Regular User Tokens by Clearing Enable API Access
Clearing Enable API Access stops the user's tokens from working. ShipHero does not delete the tokens. If you select Enable API Access again, the same tokens work again.
- Go to the Users & Roles page and select the name of the user.
- Go to the API Access section at the bottom of the user's profile.
- Clear Enable API Access.
- Save the user.
Revoke ShipHero Regular User Tokens by Deactivating the User
Deactivating a user stops both its API Access Token and its Refresh Token from working. If you reactivate the user, the tokens work again.
- Go to the Users & Roles page and select the name of the user.
- Toggle off Activate user. For more detail, see How to Create and Manage Users in ShipHero.
- To keep the integration running, create a new user for it and turn on Enable API Access. See How to Give a ShipHero User API Access.
Create a New User If a Token May Be Exposed
If you deactivate a user because its tokens may be exposed, do not reactivate the user. Reactivating the user makes the old tokens work again. Create a new user for the integration instead.
Need Help Revoking ShipHero API Access?
If you are not sure which type of token you have, or you need help revoking it, email support@shiphero.com. ShipHero Support will help you finish the revocation.