⚡ For online stores & logistics partners

One webhook = every order shipped.

Plug ParcelMtandao into your Shopify, WooCommerce, or custom cart in minutes. POST an order, we create a tracked shipment with a printable label, real-time SMS, and live status webhooks back to your store.

Two ways to integrate

Pick the one that fits how your cart works.

🛒

eShop webhook

Your cart POSTs an order to a URL we issue you. We auto-create the shipment, return the tracking number, and notify the recipient by SMS.

  • Zero code in your cart if it supports webhooks
  • HMAC-SHA256 signed for security
  • Pending-orders queue if anything fails — never lose an order
See the webhook spec →
🧱

REST API

Direct programmatic access. Build your own checkout, your own dashboards, your own tracking widgets. We expose rates, shipments, and tracking.

  • Live rate quoting
  • Create shipments + get barcodes
  • Track any shipment by number
See the API endpoints →

eShop webhook

POST https://parcelmtandao.com/api/webhook/eshop/{integration_id}
X-Signature: sha256=<hmac-sha256 of body using webhook_secret>
Content-Type: application/json

{
  "external_order_id": "SHOP-12345",
  "recipient": {
    "first_name": "Asha",
    "last_name":  "Mwangi",
    "phone":      "+254712345678",
    "email":      "asha@example.com",
    "address":    "123 Tom Mboya St, Nairobi"
  },
  "dest_office_id": 5,
  "items": [
    { "description": "Sneakers", "weight_kg": 1.2,
      "length_cm": 30, "width_cm": 20, "height_cm": 12 }
  ]
}

// Response 200 OK:
{ "shipment_number": "SHP-20260606-A1B2C3D4",
  "total": 580.00,
  "currency": "KES",
  "tracking_url": "https://parcelmtandao.com/tracking.php?number=SHP-…" }

Signature verification

Every webhook is signed with HMAC-SHA256 of the raw request body using the webhook_secret we issue. Verify it before processing: 

// PHP example
$expected = 'sha256=' . hash_hmac('sha256', $rawBody, $webhookSecret);
if (!hash_equals($expected, $_SERVER['HTTP_X_SIGNATURE'] ?? '')) {
  http_response_code(401); exit('Bad signature');
}

REST API endpoints

Every request is authenticated with X-API-Key + X-API-Secret. Keys are bcrypt-hashed at rest.

GET /api/v1/offices List pickup & dropoff locations available to your company
GET /api/v1/rate Quote a single shipment by route + weight + service tier
GET /api/v1/rates/all Quote all service tiers at once (rate comparison)
POST /api/v1/shipments Create a confirmed shipment, get back the tracking number + barcodes
GET /api/v1/track/{shipment_number} Pull live tracking + history for one of your shipments

Authentication

Two headers per request: 

X-API-Key:    your_api_key
X-API-Secret: your_api_secret

Secrets are bcrypt-hashed at rest — we never store them in cleartext. If you lose one, revoke the key and we'll issue a new one. Old API requests with the revoked key fail with 401.

Ready to integrate?

Sign up your store. We'll issue API keys + a webhook URL within one business day.

✉ Email support to get started

Include: your company name, contact person, expected monthly volume, and which endpoints you need.