Skip to main content

​
Environments

The Flex Forward API provides two environments for production operations and development testing.

​
Available environments

All requests must use HTTPS. Requests over plain HTTP will be rejected.

​
Development environment

The development environment connects to courier sandbox services (e.g., YunExpress sandbox). Use it for:
  • Testing your integration without creating live shipments
  • Validating request formats and response handling
  • Developing error handling and retry logic
Sandbox courier services may return simulated tracking data and label documents. Behavior may differ from production in response timing and available tracking statuses.

​
Sandbox test data

The development environment supports test values that produce predictable tracking responses. Use these to verify your integration handles different shipment outcomes:
Test values and simulated responses are subject to change. Contact the Flex Forward team for the latest sandbox test data.

​
Credential separation

Use separate API key + API token pairs for each environment. Do not use production credentials in development or vice versa. Both pairs are created and managed by you in the User Portal; Flex Forward does not issue or rotate them.
Production credentials have access to live courier services. Always verify which environment you are targeting before making requests.

​
Credential best practices

  • Store API keys and tokens in environment variables or a secrets manager
  • Never hard-code credentials in source code or commit them to version control
  • Use separate credentials per environment to prevent accidental production requests during development
  • Regenerate credentials in the User Portal whenever your own security policy requires it; Flex Forward does not rotate or expire them for you
See Authentication for details on header usage and error responses.

​
Rate limits

Rate limits are not currently enforced. As a guideline, keep request volume below 10 requests per second per account. Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) are not currently included in responses. Every endpoint already declares an HTTP 429 Too Many Requests response with a Retry-After header (seconds to wait). Implement that handling now so your integration is unaffected when limits are enforced: on 429, pause for Retry-After seconds and retry the same request. See Error handling. If rate limiting is introduced in the future, it will be communicated through the Changelog with advance notice. Contact the Flex Forward team at [email protected] to discuss capacity planning for high-throughput integrations.

​
Go-live checklist

Before switching from development to production:
  • Recommended: test your integration in the sandbox first, using development credentials from the User Portal
  • Production API key and token retrieved from the User Portal (Settings → Signing Key and API Token)
  • Shipper account configured for production courier(s)
  • Label creation tested successfully in development
  • Label document retrieval tested
  • Tracking retrieval tested
  • Idempotency behavior verified (same key and body replay; changed body returns IDEMPOTENCY_CONFLICT)
  • Error handling implemented for all status codes
  • Required courier and shipping lane setup confirmed

​
HTTPS requirement

All API endpoints require HTTPS with TLS 1.2 or higher. Requests sent over plain HTTP will receive a connection error.