Effective date: 25/07/2026 Action required before: 31/07/2026To strengthen the protection of order and customer data, Boxme is upgrading the security standards for all API integrations. Two changes apply to every integration. Please review and update your setup before the effective date to avoid interruption.1. IP Whitelist#
From the effective date, Boxme APIs only accept requests from IP addresses you have registered and we have approved. Requests from unregistered IPs will be rejected.
How to register#
Register your server IP(s) via https://app.omisell.com > Integrated API Tool.
Registered IPs must be re-confirmed every 180 days. A reminder is sent before the due date; if not re-confirmed in time, affected connections may be rejected until updated.Error handling#
When a request comes from a non-whitelisted IP, the API returns:HTTP 401 — {"error": true, "error_code": 401, "messages": "Client IP is not allowed for this API key."} (hoặc "Business IP whitelist is not configured…" khi chưa cấu hình). Không có mã IP_NOT_WHITELISTED; kiểm tra IP gọi đã được đăng ký và duyệt chưa.Handle this by ensuring the calling IP is registered and approved.2. API Key Expiration#
API keys now have a maximum lifetime of 1 year (365 days). When creating a key, you can choose a shorter expiry that fits your needs.Creating a key with expiry#
When creating a key, set the expiry via the expired_time field (unix seconds, mốc tuyệt đối) (e.g. 30, 90, 180 days, or up to 365).expired_time không sửa được sau khi tạo key — hết hạn thì phải phát hành key mới. Bỏ trống thì mặc định 365 ngày.
Migration checklist#
Register and get approval for all calling server IPs
Set a calendar reminder to re-confirm IPs every 180 days
Review all active API keys
Reissue keys under the new expiry policy before 31/07/2026
Add handling for the IP and key-expiry error responses
3. Support#
Questions or help with migration:Thank you for helping us keep the platform secure. 