Skip to main content

Test an App with a BoxNCase Workspace

You can run your own app on your development machine and connect it to a managed BoxNCase test workspace. The BoxNCase platform itself remains managed; you do not need to install or operate the commerce backend locally.

Prerequisites​

  • Access to a BoxNCase test workspace
  • Permission to install or manage apps
  • A local development environment for your app
  • An HTTPS tunnel or preview deployment that BoxNCase can reach

1. Start your app​

Run the app using its normal development command. Confirm that its manifest, registration endpoint, and webhook endpoints respond locally before exposing them through a tunnel.

2. Create a public HTTPS URL​

BoxNCase must reach the app from the internet during installation and webhook delivery. Use an approved HTTPS tunnel or a short-lived preview deployment. Set the app's public base URL to that HTTPS origin, then restart the app.

caution

Treat a tunnel URL as temporary. Do not use it for production integrations or leave production credentials attached to it.

3. Validate the manifest​

Open the public manifest URL and confirm that:

  • every app and webhook URL uses the same expected HTTPS origin;
  • the app identifier is stable;
  • permissions are limited to the test workflow; and
  • no localhost, private-network, or production URL appears.

See App manifest.

4. Install in the test workspace​

In the BoxNCase Dashboard, go to Extensions, choose Install external app, and enter the public manifest URL. Review the requested permissions before approving the installation.

5. Exercise the full event path​

Perform the action that should trigger the integration, such as updating a product or creating a test order. Verify the webhook signature, event ID, retry behavior, API call, and resulting BoxNCase state. Make the handler idempotent before testing retries.

6. Prepare for production​

Deploy the app to a stable HTTPS domain, create production-specific secrets, update its allowlist, and repeat installation in the production workspace. Never copy a test token into production.

For deeper troubleshooting, see Developing with tunnels and App error codes.