Effective date: 25/07/2026 Action required before: 31/07/2026To strengthen the protection of order and customer data, Boxme is upgrading the security standards for all API integrations. Two changes apply to every integration. Please review and update your setup before the effective date to avoid interruption.1. IP Whitelist#
From the effective date, Boxme APIs only accept requests from IP addresses you have registered and we have approved. Requests from unregistered IPs will be rejected.
How to register#
Register your server IP(s) via https://app.omisell.com > Integrated API Tool.
Registered IPs must be re-confirmed every 180 days. A reminder is sent before the due date; if not re-confirmed in time, affected connections may be rejected until updated.Error handling#
When a request comes from a non-whitelisted IP, the API returns:HTTP 401 — {"error": true, "error_code": 401, "messages": "Client IP is not allowed for this API key."} (or "Business IP whitelist is not configured…" when no whitelist has been set up). There is no IP_NOT_WHITELISTED code; check that the calling IP has been registered and approved.Handle this by ensuring the calling IP is registered and approved.2. API Key Expiration#
API keys now have a maximum lifetime of 1 year (365 days). When creating a key, you can choose a shorter expiry that fits your needs.Creating a key with expiry#
When creating a key, set the expiry via the expired_time field (unix seconds, an absolute point in time) (e.g. 30, 90, 180 days, or up to 365).expired_time cannot be changed once the key has been created — when it expires you must issue a new key. Leave it empty and it defaults to 365 days.
Migration checklist#
Register and get approval for all calling server IPs
Set a calendar reminder to re-confirm IPs every 180 days
Review all active API keys
Reissue keys under the new expiry policy before 31/07/2026
Add handling for the IP and key-expiry error responses
3. Support#
Questions or help with migration:Thank you for helping us keep the platform secure. 