Log Into ShipHero → Auth Cookies

Logs into the ShipHero web app for a given brand and hands back the authenticated session cookies. Other scenarios use those cookies to call ShipHero's internal dashboard endpoints that require a logged-in session rather than an API token.

At a glance

• Status: Active
• Trigger: POST webhook (/webhook/21593503-b13d-4fbb-a61c-d7b550598c48), responds via a Respond-to-Webhook node; also a manual trigger.
• Runs on: Called on demand by SKU flows that need a live ShipHero dashboard session.
• Talks to: ShipHero (web login flow); Supabase (credential-lookup RPC).

How it works

1. The flow enters via webhook (body.brand_id) or the manual trigger, which defaults brand_id to 1; both funnel through a "Pick One Input" node.
2. Get Brand Shiphero Credentials calls the Supabase RPC get_shiphero_credentials for the brand's username and password.
3. It walks ShipHero's multi-step login redirect chain with redirects disabled and the full response captured: Open First Page, Auth Scopes, Login ID, extract the hidden state value via regex, Verify, Password, Submit, Resume Auth, Do Login.
4. After each hop, Cookie Array code nodes merge set-cookie headers into a running cookie jar, and If nodes gate each step on the expected HTTP status.
5. The final merged cookie string is returned via Send Access Cookies Back.

Notes

• Brittle by design. Each step asserts an exact redirect status, so any change to ShipHero's login flow breaks the chain.
• Retry-on-fail is set on the credential fetch and the response node.

Related

• Get the 2FA Code
• ShipHero Access Token Rotation
• Supabase RPC: Secret Insert/Read
• SKU Information Handler
• Pull Brand SKUs
• Data Flows