Effective date: 25/07/2026 Action required before: 31/07/2026To strengthen the protection of order and customer data, Boxme is upgrading the security standards for all API integrations. Two changes apply to every integration. Please review and update your setup before the effective date to avoid interruption.1. IP Whitelist#
From the effective date, Boxme APIs only accept requests from IP addresses you have registered and we have approved. Requests from unregistered IPs will be rejected.How to register#
Register your server IP(s) via https://app.omisell.com > Setting and wait for approval.
Registered IPs must be re-confirmed every 180 days. A reminder is sent before the due date; if not re-confirmed in time, affected connections may be rejected until updated.Error handling#
When a request comes from a non-whitelisted IP, the API returns:HTTP [403] — [error code / message, e.g. IP_NOT_WHITELISTED]Handle this by ensuring the calling IP is registered and approved.2. API Key Expiration#
API keys now have a maximum lifetime of 1 year (365 days). When creating a key, you can choose a shorter expiry that fits your needs.Creating a key with expiry#
When creating a key, set the expiry via the [expiry parameter, e.g. expires_in / expiry_date] field (e.g. 30, 90, 180 days, or up to 365).Migration checklist#
Register and get approval for all calling server IPs
Set a calendar reminder to re-confirm IPs every 180 days
Review all active API keys
Reissue keys under the new expiry policy before 31/07/2026
Add handling for the IP and key-expiry error responses
3. Support#
Questions or help with migration:Thank you for helping us keep the platform secure. Modified at 2026-07-23 17:07:36
