How to save POST variables securely using entity api
It really depends on how ShipWorks works. If it lets you specify a URL when it downloads the order data, you could use a secret key appended to the URL that you can use to authenticate a request as Ayeshk mentions. If it allows the merchant to specify a URL in a configuration form, at least you can set the secret key once and have the merchant copy it, kind of like how Drupal appends a secret key to the cron URL.

I also have a project upcoming that requires ShipWorks. Are you sharing the code publicly anywhere?