Integration Starter Checklist

Use this checklist when creating a BoxNCase integration in your preferred web framework. BoxNCase does not require a platform repository or a local commerce backend: your service connects to a managed test workspace over HTTPS.

Required surfaces

Surface	Purpose	Required
Manifest endpoint	Declares app identity, URLs, permissions, and webhooks	Yes
Registration endpoint	Receives the installation token	When the app calls protected APIs
Webhook endpoints	Receive signed asynchronous or synchronous events	When events are declared
Dashboard route	Renders app configuration or workflow UI	Optional

Recommended project boundaries

Keep these responsibilities separate even if they begin in one service:

src/
  app-identity/       manifest and version
  auth/               installation records and token encryption
  commerce-api/       typed GraphQL operations
  webhooks/           signature checks, idempotency and handlers
  dashboard/          browser-safe embedded interface
  observability/      request IDs, delivery logs and alerts

Never expose an installation token to browser code. Resolve the installation on the server from the workspace domain or app ID, then make the API request from a trusted runtime.

Development sequence

1. Obtain a managed BoxNCase test workspace.
2. Implement and validate the manifest.
3. Add registration and encrypted token storage if protected API access is needed.
4. Request only the permissions used by the first workflow.
5. Add one signed, idempotent webhook at a time.
6. Install the app in the test workspace and inspect delivery logs.
7. Deploy to a stable production HTTPS origin before requesting production access.

Release gate

Before promoting the integration, verify that:

• manifest and webhook URLs use the production origin;
• test and production credentials are isolated;
• webhook signatures are verified before parsing business data;
• duplicate event IDs do not repeat side effects;
• API and provider requests have timeouts and bounded retries; and
• operators can trace a BoxNCase request ID through the integration.

Start with the Apps quickstart, then review App requirements and Installation protection.