Developer API

All API requests must include a Bearer token in the Authorization header. API keys are prefixed with twft_ and can be generated from your account settings. API access must be enabled on your account by Twyft — contact us if you need it activated.

Authorization: Bearer twft_your_api_key_here

All endpoints are HTTPS only. HTTP requests will be rejected.

Create, list, and retrieve shipments programmatically.

Webhooks let Twyft push tracking events to your server in real time, eliminating the need to poll the API. Configure endpoints from your account settings.

Event Types

Verifying Signatures

Every delivery includes an X-Twyft-Signature header containing sha256=<hex>. Compute HMAC-SHA256 of the raw request body using your endpoint secret and compare.

const crypto = require('crypto');

function verifySignature(rawBody, secret, header) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header)
  );
}

Retry Policy

If your endpoint returns a non-2xx response or times out (10s), Twyft will retry up to 3 times with exponential backoff: 5 seconds, 30 seconds, then 2 minutes. After 3 failures the delivery is abandoned and logged.

Your endpoint should return a 2xx response as quickly as possible — process the payload asynchronously if needed. Delivery logs are visible in your webhook settings.