The verdict in three sentences
As long as e-commerce clients send their orders as Excel files, a logistics company in Tunis pays for manual data entry, address errors and tracking calls that should not exist. A secure public API costs between TND 60,000 and 160,000 excl. VAT in 2026, depending on the number of resources exposed, the security level and the tooling provided to partners. With OAuth 2, OpenAPI documentation and a sandbox, the goal of 15 partner integrations in the first year becomes realistic.
What file exchanges cost
The CTO describes the daily routine: every morning, around forty online shops send a shipment file, each in its own format. Two operators rework them, fix misspelled governorates and re-enter what fails to import. In the evening, another file goes back with delivery statuses, which clients must reload into their shop. Result: 1.5 to 2% address errors, statuses 24 hours late and a customer service team answering instead of online tracking.
| Indicator (2026 order of magnitude) | Excel exchanges | Public API |
|---|---|---|
| Time from order to pickup scheduling | 12 to 24 h | a few seconds |
| Address or format errors | 1.5 to 2% | under 0.3% (input validation) |
| Delivery status freshness | D+1 | real time via webhook |
| Daily reprocessing time | 6 to 8 operator hours | under 1 h |
| Time to connect a new client | 1 to 2 weeks | 2 to 5 days with documentation |
| "Where is my parcel" calls | 15 to 20% of parcels | 5 to 8% |
API scope and price
A public API is more than a set of endpoints: it is a product whose users are partner developers. The core exposes shipment creation, rate calculation, tracking and labels. Around it you need authentication, documentation, a sandbox, monitoring and a developer portal.
| Scope | Content | 2026 budget excl. VAT | Timeline |
|---|---|---|---|
| API core | shipments, rates, tracking, labels, API keys, OpenAPI documentation | TND 60,000 to 80,000 | 10 to 12 weeks |
| + Advanced security | OAuth 2 client credentials, secret rotation, rate limiting, audit logs | TND 80,000 to 105,000 | 12 to 14 weeks |
| + Webhooks and sandbox | signed status events, replay, test environment with dummy data | TND 105,000 to 130,000 | 14 to 16 weeks |
| Partner platform | developer portal, PHP and JavaScript SDKs, WooCommerce and Shopify modules, per-partner statistics | TND 130,000 to 160,000 | 16 to 20 weeks |
| External security audit | penetration test before launch | TND 8,000 to 15,000 | 2 to 3 weeks |
| Operations | hosting, 24/7 monitoring, API gateway, partner support | TND 3,000 to 7,000 per month | ongoing |
Ready-made WooCommerce and Shopify modules are often the best investment: most Tunisian shops have no developer and integrate in an hour with a plugin.
Security: what the specification must require
An API exposed on the internet is attacked from the first week. The specification must include: OAuth 2 authentication with short-lived tokens, separate keys for sandbox and production, per-partner rate limiting (for example 600 requests per minute), strict input validation, HMAC-signed webhooks, TLS 1.2 minimum and logging of every call. Recipient data (name, phone, address) is personal data under Tunisia's 2004 organic law: processing must be declared to the INPDP and each partner must only see its own shipments. Finally, version the API from day one (/v1/) so the service can evolve without breaking integrations.
Mini case study
Sami, CTO of a logistics company in Tunis, handles 4,000 parcels a day for 40 shops. Two operators spend 7 hours a day reprocessing files, at a loaded cost of TND 2,200 per month each, or TND 52,800 a year. Address errors (1.8% of parcels) cost about TND 4 each in returns: 4,000 x 1.8% x TND 4 x 300 days = TND 86,400 a year. With the API, he keeps one part-time operator and brings errors down to 0.3%, saving about TND 110,000 a year. Chosen project: core + advanced security + webhooks for TND 118,000 excl. VAT, plus TND 12,000 for a penetration test. Payback: about 14 months, before even counting new clients won thanks to integration in a few days.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Do we need OAuth 2 or are API keys enough?
API keys are enough for a first pilot with 2 or 3 partners. Beyond 10 integrations, or as soon as personal data flows, OAuth 2 with 15 to 60 minute tokens is the standard.
How should API access be billed?
Most logistics firms include it in the per-parcel rate to win clients. Others bill high volumes above 100,000 calls a month, with the API gateway metering consumption per partner.
How long does a partner take to integrate?
With clear OpenAPI documentation and a sandbox, a developer connects a shop in 2 to 5 days. With a WooCommerce plugin, installation takes under an hour.
Where should the API be hosted?
Hosting in Tunisia simplifies INPDP compliance; a European cloud offers more managed services. Either way, plan for 99.9% contractual availability and 24/7 monitoring.
What happens when the API evolves?
Versioning (/v1/, /v2/) lets you keep the old version running 6 to 12 months while partners migrate. A published changelog avoids surprise breakages.
Let's scope your project. Describe your partner flows, volumes and security requirements: we will price the API scope, an indicative budget in TND excl. VAT and the production timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
