How your FedEx credentials are stored and protected

The video summarizes how secrets and endpoints are protected; the written notes below go into detail.

​

Secrets at rest

The plugin stores four secrets: the FedEx Client Secret, the two Tracking credentials, and the Webhook Shared Secret. They are entered on the Settings screen — the Tracking tab and the Authorization tab — and saved with your site’s settings, the same way WordPress saves every other setting. They are not encrypted at rest — this is standard for WordPress settings, not a special weakness of this plugin, but you should treat your wp-admin like the key cabinet it is. On screen, secret fields show dots instead of characters, with a Show/Hide button next to each field when you need to check what you pasted. Because the saved value has to be usable, it is present in the page when the Settings form loads — one more reason to keep wp-admin logins limited to people you trust. Never share your keys or secrets — not by email, chat, or support tickets. If a secret has been shared or exposed, rotate it in the FedEx Developer Portal and enter the new value in Settings. If your setup genuinely needs secrets managed outside WordPress, that is a customization: your developer can arrange it (see the developer reference).

​

How the webhook is protected

The tracking webhook is the one place where FedEx sends messages to your store. To make sure a message really comes from FedEx, the plugin uses a shared password, the Webhook Shared Secret:

• You set the secret in WordPress Admin → FedEx Shipping → Settings → Tracking tab → Webhook Shared Secret, and paste the same secret into your FedEx webhook subscription (see Tracking webhooks).
• FedEx signs every message it sends with your shared password. Messages without a valid signature are refused.
• The technical name for this is an HMAC-SHA256 signature, checked against the fdx-signature header on the route POST /fshipping/v1/aiv-webhook.
• If the secret is not set in Settings, every delivery is refused with a 401 response — nothing unverified is ever accepted. This is why setting the secret is recommendation 1 below.

​

Public endpoints

Full route reference: REST API. Shipment records are non-public and hidden from WordPress’s programming interfaces by design — no sitemap, no archive, no unauthenticated reads.

​

Destructive operation to know

Permanently deleting a canceled shipment record on the Shipments list permanently deletes the linked WooCommerce order. Non-canceled shipments cannot be trashed or deleted at all. See Uninstalling and removing your data and the data model.

​

Recommendations

1. Set the Webhook Shared Secret in Settings → Tracking immediately after install, even before subscribing the webhook — until it is set, the webhook refuses every delivery, and setting it is what switches the receiver from closed to authenticated.
2. If you expose the rate-quote endpoint publicly, put a CDN/WAF rule in front of it for an extra rate-limit layer.
3. Keep the Settings page behind role editing (default: store administrators only).
4. Have your developer audit any custom code that hooks into the shipment pipeline — it can block or allow paid label purchases.
5. Rotate FedEx secrets from the Developer Portal periodically; update them in Settings (no restart needed).

​

What’s next