Courier providers

The courier integration is a shared, versioned package. Each adapter maps its vendor’s API onto one canonical shape (create_consignment / fetch_label / parse_webhook, and vendor statuses → a canonical courier status), so switching courier is a config change, never an edit.

What’s available

Setting value	Courier
pathao	Pathao
steadfast	Steadfast
redx	RedX

The settings

Setting	Purpose	Default	Where
courier_provider	The courier to use for this store	blank → the deployment default, then the first with credentials	Tenant config → Providers
COURIER_DEFAULT_PROVIDER	Deployment-wide default courier	"" (unset)	.env
courier credentials	API keys for the courier	—	Integrations (encrypted)

The active courier resolves in order: TenantConfig.courier_provider → COURIER_DEFAULT_PROVIDER (.env) → the first courier that has credentials.

Wiring a courier

1. Add the courier’s credentials as an App integration — encrypted at rest automatically.
2. Set courier_provider in the tenant config (or COURIER_DEFAULT_PROVIDER in .env for a deployment-wide default).
3. For Steadfast, set the merchant portal Callback URL to https://YOUR_API_HOST/api/couriers/webhook/steadfast/ and paste the same Webhook secret (Auth Token) from Nudova’s Steadfast provider card into Steadfast’s Auth Token field.
4. For Pathao, set the portal Callback URL to https://YOUR_API_HOST/api/couriers/webhook/pathao/ and paste the same Webhook secret into Nudova’s Pathao provider card.

Credentials are handled securely — and never echoed

Courier API keys live only in the encrypted Integrations store, never in the tenant config or .env, and are never returned by the public config endpoint. The config only names which courier is active.

Swapping a courier

Moving Pathao → Steadfast (or adding RedX) is: add the new courier’s credentials, change the selection. No redeploy of application code, no image rebuild — the shared package already knows how to talk to each.

Delivery pricing is separate

Which courier carries a parcel is one thing; what you charge the customer for delivery is another. See Delivery zones & fees.

Status updates

Couriers push status to POST /api/couriers/webhook/<provider>/. Admin Refresh tracking also polls Pathao (GET /orders/{id}) and Steadfast (GET /status_by_cid/{id}) when a consignment is already booked.

Pathao webhook: set Callback URL to https://YOUR_API_HOST/api/couriers/webhook/pathao/ and the same Webhook secret in Pathao’s portal and in Nudova (Providers → Pathao). Pathao sends X-PATHAO-Signature with that secret; Nudova echoes X-Pathao-Merchant-Webhook-Integration-Secret on HTTP 200 (required by Pathao).

Steadfast webhook: set Callback URL to https://YOUR_API_HOST/api/couriers/webhook/steadfast/ and the same Webhook secret (Auth Token) in Steadfast’s portal and in Nudova. Steadfast sends Authorization: Bearer … with that token (falls back to the API key if no dedicated webhook secret is saved).

Partial delivery (partial_delivered / partial_delivery) advances the parcel to delivered for fulfilment, but COD is not marked paid at the full booked amount unless the courier reports a collected figure.

RedX has no tracking refresh yet

RedX books consignments and fetches labels the same as Pathao and Steadfast, but it has neither a polling Refresh tracking endpoint nor a documented, secret-verified webhook setup step yet. Until that ships, a RedX parcel’s status in Nudova can lag what RedX’s own portal shows.

Test connection

All three couriers run a live check today: Pathao lists stores, Steadfast reads merchant balance, and RedX lists pickup stores. All three are free, read-only calls — the button says Connected when that round-trip succeeds.

Nudova won't claim a connection it didn't make

Where a vendor offers a free, side-effect-free check, the button says Connected and means it. See Payment providers → Test connection.

Related: Provider packages · Payment providers · SMS provider · Phone-risk provider · COD & fraud review.