Turship Tracking API

const crypto = require('crypto');
const express = require('express');
const app = express();

app.post('/turship/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Turship-Signature') || '';
  const sig = Object.fromEntries(header.split(',').map(p => p.split('=')));
  if (!/^\d+$/.test(sig.t || '') || !/^[a-f0-9]{64}$/.test(sig.v1 || '')) {
    return res.status(400).send('Invalid signature');
  }
  const expected = crypto.createHmac('sha256', process.env.TURSHIP_WEBHOOK_SECRET)
    .update(`${sig.t}.${req.body}`).digest('hex');
  const valid = sig.v1 && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1))
    && Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  if (!valid) return res.status(400).send('Invalid signature');
  const event = JSON.parse(req.body);
  // update your order using event.data.reference / event.data.status.code
  res.sendStatus(200);
});

import hmac, hashlib, os, time, json
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/turship/webhook")
def turship_webhook():
    raw = request.get_data()
    sig = dict(p.split("=", 1) for p in request.headers.get("X-Turship-Signature", "").split(",") if "=" in p)
    if not sig.get("t", "").isdigit() or len(sig.get("v1", "")) != 64:
        abort(400)
    expected = hmac.new(os.environ["TURSHIP_WEBHOOK_SECRET"].encode(), f"{sig.get('t')}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig.get("v1", "")) or abs(time.time() - int(sig.get("t", 0))) > 300:
        abort(400)
    event = json.loads(raw)
    # update your order using event["data"]["reference"]
    return "", 200

// Node 18+ (built-in fetch)
async function trackShipments(numbers) {
  const res = await fetch('https://flytfrance.com/api/v1/track', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.TURSHIP_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ tracking_numbers: numbers.slice(0, 100) }),
  });
  if (res.status === 429) {
    const wait = Number(res.headers.get('Retry-After') || 5);
    await new Promise(r => setTimeout(r, wait * 1000));
    return trackShipments(numbers);
  }
  const data = await res.json();
  if (!data.ok) throw new Error(data.error.message);
  return data.results;
}

import os, requests

def track_shipments(numbers):
    r = requests.post(
        "https://flytfrance.com/api/v1/track",
        headers={"Authorization": f"Bearer {os.environ['TURSHIP_API_KEY']}"},
        json={"tracking_numbers": numbers[:100]},
        timeout=10,
    )
    r.raise_for_status()
    return r.json()["results"]

for s in track_shipments(["TS4827193056", "TS6388578830"]):
    print(s["tracking_number"], s["status"]["label"] if s["found"] else s["error"]["code"])

<!-- Calls YOUR server proxy (never Turship directly — keep the API key secret) -->
<form id="track-form">
  <input id="track-input" placeholder="Tracking number" required>
  <button>Track</button>
</form>
<div id="track-result"></div>
<script>
document.getElementById('track-form').addEventListener('submit', async (e) => {
  e.preventDefault();
  const n = document.getElementById('track-input').value.trim();
  const res = await fetch('/track.php?numbers=' + encodeURIComponent(n));
  const data = await res.json();
  const s = data.results && data.results[0];
  document.getElementById('track-result').textContent = !s ? 'Error'
    : s.found ? `${s.status.label} — ${s.status.description}` : 'Tracking number not found';
});
</script>