How does authentication differ between Shippo, EasyPost, and ShipEngine?

Shippo uses a custom Authorization: ShippoToken header. EasyPost uses HTTP Basic auth with the key as username and empty password. ShipEngine uses a custom API-Key header. ShipStation keys work against the ShipEngine API since they share a backend.

How do you fetch rates from each provider?

Shippo: POST /shipments/ with async=false returns rates inline. EasyPost: POST /v2/shipments with a nested shipment object, parcel is a single object (not array), weight in ounces. ShipEngine: POST /v1/rates, but you need a rate_options.carrier_ids array so there's typically a preflight call to GET /v1/carriers.

How do you purchase labels through each API?

Shippo: POST /transactions/ with the rate object_id. EasyPost: POST /v2/shipments/{shipment_id}/buy with both the parent shipment ID and the rate ID. ShipEngine: POST /v1/labels/rates/{rate_id}, stateful from the rate ID alone.

How do webhook signatures differ?

Shippo: HMAC-SHA256 over timestamp+body in Shippo-Auth-Signature header (t= ,v1= ). Opt-in via Shippo sales. EasyPost: HMAC-SHA256 hex with NFKD-normalized secret in X-Hmac-Signature (hmac-sha256-hex= ). Self-serve per-webhook secret. ShipEngine: RSA-SHA256 with a JWKS endpoint, requires async key fetching.

Which provider should I pick?

If you're already using one, stay there: switching rarely pays back the cost. Starting fresh with one: EasyPost for cleanest DX, Shippo for nicer dashboard, ShipEngine if you're on the ShipStation ecosystem. For optionality (carrier coverage, outage resilience), use all three via rateship.

Shippo vs EasyPost vs ShipEngine: a 2026 developer comparison

RateShip TeamApril 17, 20268 min read

If you're evaluating shipping APIs in 2026, you're almost certainly looking at Shippo, EasyPost, or ShipEngine. All three expose multi-carrier rate fetching and label purchasing over a REST API. All three accept your carrier accounts (USPS, UPS, FedEx, DHL, etc.) under one roof. All three will get the job done.

The differences show up once you start writing adapter code. Auth headers differ. Rate shapes differ. Label-purchase flows differ in ways that bite you six months in. Webhook signing schemes are all incompatible. This post is the side-by-side you wish existed before you picked one.

Authentication

All three use API key auth. None use OAuth. But the header shape varies:

Shippo: Authorization: ShippoToken <key>. Custom scheme, not the Bearer format you'd expect. Keys are prefixed shippo_test_ or shippo_live_.
EasyPost: HTTP Basic. API key as username, password empty, base64-encoded. Keys are prefixed EZ_ (test) or EZAK_ (production).
ShipEngine: API-Key: <key>. Custom header name, plain value. Keys are prefixed TEST_ or live_. ShipStation keys work against the ShipEngine API too (shared backend).

Verdict: ShipEngine has the cleanest auth. EasyPost's Basic scheme means you have to base64-encode the key every request, which most HTTP clients handle automatically but sometimes breaks if you don't know to expect it.

Rate fetching

All three return rates inline from a single POST call when you ask for synchronous rating. The payload shapes are where they diverge:

Shippo: POST /shipments/ with address_from, address_to, and a parcels array. Async is opt-out ( async: false gets inline rates). Rate amounts come back as decimal strings ( "8.40"), so you need string-based cents conversion to avoid floating-point rounding.
EasyPost: POST /v2/shipments with a nested shipment object. Parcel is a single object (not an array). Weight is in ounces, not pounds. Rate amounts are decimal strings too.
ShipEngine: POST /v1/rates. You have to supply a rate_options.carrier_ids array listing which carriers to query. That means one preflight call to GET /v1/carriers to discover what's connected. Rate amounts are numbers, not strings.

Verdict: Shippo and EasyPost are single-call; ShipEngine is technically two calls (though carrier IDs can be cached). EasyPost uses ounces which is mildly annoying if you store weights in pounds.

Label purchase

This is where the design differences matter most. Each provider has a different idea of how you go from a rate quote to a label:

Shippo: POST /transactions/ with the rate's object_id. One call. Clean.
EasyPost: POST /v2/shipments/<shipment_id>/buy with { rate: { id: rate_id } }. Needs both the parent shipment ID and the rate ID. If you only saved the rate ID, you can't buy.
ShipEngine: POST /v1/labels/rates/<rate_id>. Stateful from the rate ID alone. Label comes back with status completed, processing, or error.

All three support hard label formats (PDF) out of the box. ZPL and PNG require extra request parameters, with different names per provider.

Webhooks

This is the most chaotic surface of the three. Each provider signs webhooks differently:

Shippo: HMAC-SHA256 over <timestamp>.<body>, sent as Shippo-Auth-Signature: t=<ts>,v1=<hex>. Secret is per-account, opt-in (email Shippo sales to enable). Replay protection isn't documented so a 5-minute window is reasonable.
EasyPost: HMAC-SHA256 hex, sent as X-Hmac-Signature: hmac-sha256-hex=<hex>. Secret is user-configured per webhook in their dashboard. Their official client libs NFKD-normalize the secret before hashing, so match that or unicode-composed secrets will mismatch.
ShipEngine: RSA-SHA256 via a JWKS endpoint. This means async key fetching plus caching. Notably different from the other two.

Verdict: EasyPost is the simplest to verify correctly. Shippo is fine but requires a sales conversation. ShipEngine is the most robust but has an async key-fetching cost.

Carrier coverage

All three cover USPS, UPS, FedEx, and DHL. Beyond that, coverage diverges based on which regional carriers each provider has signed. If you care about OnTrac, LSO, Spee-Dee, or specific regional USPS services, audit each provider before committing.

The honest answer: for any single shipment, you usually get the same carrier / service set from all three. Where providers differ is in which accounts you can attach. EasyPost and Shippo let you connect your own carrier accounts directly; ShipEngine abstracts some of that behind their carrier_id system.

How we'd pick

Already using one: stay there. The cost to switch rarely pays for itself.
Starting fresh, one provider: EasyPost for the cleanest developer experience, Shippo if you want a nice dashboard, ShipEngine if you're on the ShipStation ecosystem.
Starting fresh, want optionality: use all three. Each one's outage or carrier drop becomes a graceful degradation instead of a site-down event.

That last option is what we built rateship for. One client, all three providers, a single typed API that normalizes the differences above into one shape. If you end up writing your own adapters anyway, you can rip out the parts you need (the SDK is MIT-licensed and on GitHub).