🔐 API Security Upgrade

Effective date: 25/07/2026 Action required before: 31/07/2026

To strengthen the protection of order and customer data, Boxme is upgrading the security standards for all API integrations. Two changes apply to every integration. Please review and update your setup before the effective date to avoid interruption.

1. IP Whitelist

From the effective date, Boxme APIs only accept requests from IP addresses you have registered and we have approved. Requests from unregistered IPs will be rejected.

How to register

Register your server IP(s) via https://oms.boxme.asia > Setting and wait for approval.
Registered IPs must be re-confirmed every 180 days. A reminder is sent before the due date; if not re-confirmed in time, affected connections may be rejected until updated.

Error handling

When a request comes from a non-whitelisted IP, the API returns:

HTTP [403] — [error code / message, e.g. IP_NOT_WHITELISTED]

Handle this by ensuring the calling IP is registered and approved.

2. API Key Expiration

API keys now have a maximum lifetime of 1 year (365 days). When creating a key, you can choose a shorter expiry that fits your needs.

Creating a key with expiry

When creating a key, set the expiry via the [expiry parameter, e.g. expires_in / expiry_date] field (e.g. 30, 90, 180 days, or up to 365).

Migration checklist

Set a calendar reminder to re-confirm IPs every 180 days

Review all active API keys

Reissue keys under the new expiry policy before 31/07/2026

Add handling for the IP and key-expiry error responses

3. Support

Questions or help with migration:

Email: support@boxme.asia or Account Manager Executive.

Thank you for helping us keep the platform secure.

1. IP Whitelist#

How to register#

Error handling#

2. API Key Expiration#

Creating a key with expiry#

Migration checklist#