You still need an API for getting new codes. If you're willing to switch apps and manually generate a new code every time you order something online, you likely don't order often enough to be relevant to any e-commerce company
The problem should be inverted - use the package tracking number as code. This way, every code is unique, hard to guess, and the delivery person has it literally printed on the box. Being able to update the lock with expected tracking numbers is something that could be done simply and via local network.
This is fairly complicated to do locally and securely. If any e-commerce website/app could add tracking numbers as PINs to your smart lock via the local network, that would be a security nightmare. You'd also have to provision domains for every smart lock so that every lock can get Let's Encrypt certs and accept requests from web browsers without configuration. Not to mention most tracking numbers are easily guessable because they consist of a destination code and an auto-increment integer.
Also a lot of companies don't assign a tracking number until the package gets transferred to the last mile carrier. Again, if you're willing to manually copy-paste the tracking number after you get the shipping notification every single time you order something, you're clearly not part of the target demographic
It’s not complicated at all. I get shipment notification from Amazon, tap in, copy tracking then paste into browser interface of iot thingy. I think you might be one of those guys who types 500 lines of code when 50 will do the job.
No you don’t. I enter code into browser of iOt thingy, set to expire midnight on delivery day, copy/paste to Amazon when placing order. NBD. I could even reuse the same one over and over if I want, just enable it when a delivery is due.