Skip to main content

Apps Development Quickstart

BoxNCase apps are HTTPS services that extend a managed workspace through the Commerce API, signed webhooks, and Dashboard extension points. Your team owns and deploys the integration; BoxNCase operates the commerce platform.

Before you start​

You need:

  • a BoxNCase test workspace;
  • permission to install external apps;
  • an HTTPS deployment or temporary development tunnel for your app; and
  • a server runtime capable of receiving JSON requests.

You do not need to install the BoxNCase platform or run the commerce backend on your machine.

1. Create an app service​

Use your normal application stack. The service must expose a public manifest endpoint and, when it needs API access, a registration endpoint. A typical layout is:

/api/manifest       GET   app identity, permissions and webhook declarations
/api/register       POST  installation token exchange
/api/webhooks/*     POST  signed event handlers
/app/*              GET   optional Dashboard interface

See App requirements for the required request and response shapes.

2. Define the manifest​

Start with the smallest permission set your integration needs. Keep every URL on the same expected HTTPS origin and use a stable, reverse-domain identifier.

{
  "id": "com.example.inventory-sync",
  "name": "Inventory Sync",
  "version": "1.0.0",
  "appUrl": "https://integration.example.com/app",
  "manifestVersion": 2,
  "permissions": ["MANAGE_PRODUCTS"],
  "tokenTargetUrl": "https://integration.example.com/api/register",
  "webhooks": []
}

Validate the response against App manifest before installing it.

3. Install it in the test workspace​

In BoxNCase Dashboard, open Extensions, choose Install external app, and enter the manifest URL. Review the app identity, origin, and permissions before approving the installation.

If the app is still running on your development machine, follow Test an app to expose only the integration over a temporary HTTPS tunnel. The BoxNCase workspace remains managed.

4. Verify the event path​

Trigger a test event, confirm its signature and event ID, then call the managed Commerce API with the installation token. Store secrets only on the server and make webhook handlers idempotent before testing retries.

Continue with Installing apps, Webhooks, and App SDK.