Integrate against the deployment you run.

Generate a client from its OpenAPI document, use SDKs for specialised surfaces, and connect surrounding systems through signed events and explicit provider ports.

API request
$ curl $BOX_HOST/orders/ord_7Q2 \
  -H "Authorization: ******"

200 OK
{ "id": "ord_7Q2", "status": "paid" }

Your deployment is the contract

There is no shared Box API gateway. Fetch the OpenAPI document from the engine you are integrating with because its routes reflect the packages actually installed there.

Generate a TypeScript client
curl $BOX_HOST/openapi.json -o openapi.json
box codegen --lang ts --from openapi.json
npm install @box/client

Request and response

Get an order
curl $BOX_HOST/orders/ord_7Q2 \
  -H "Authorization: Bearer $BOX_TOKEN"
Response
{
  "id": "ord_7Q2",
  "merchant": "mch_41",
  "channel": "counter",
  "status": "paid",
  "total": 537500,
  "currency": "NGN",
  "payment": { "id": "pay_5K1", "method": "card" }
}

Orders, customers, payments, and settlement retain the same identifiers across websites, counters, links, and institution-built surfaces.

SDKs for specialised surfaces

Generated clients cover the engine contract. The retail SDK adds device pairing, hardware-backed keys, local catalogue state, and an offline queue for tills.

Kotlin
implementation("shop.box:arr-core:2026.9")
implementation("shop.box:arr-compose:2026.9") // optional UI
TypeScript
import { Box } from "@box/client"

const box = new Box({ host, token })
const order = await box.orders.get("ord_7Q2")

Signed events instead of polling

Subscribe
box webhooks add \
  --url https://ops.yourbank.example/box \
  --event order.paid
Payload
{
  "event": "order.paid",
  "merchant": "mch_41",
  "order": "ord_7Q2"
}

Payloads carry identifiers rather than stale copies of records. Verify the delivery signature, then fetch the current record from your own engine.

Bind providers at explicit ports

Payment adapter
box ports bind payment --adapter your-acquirer

Payments, delivery, messaging, tax, and banking integrations implement contracts owned by the deployment. Your institution keeps the provider relationship and credentials.