Skip to content
React Box

Developers

Integrating React Box

An integration acts on behalf of your organization, with the rights you give it — and nothing else.

Updated on August 14, 2026

Four rules

They hold for any integration, whatever technology sits on the other side.

  • A key belongs to the organization, not to a person: someone leaving does not break the integration, and the integration never inherits an individual's rights.
  • A key carries only the scopes ticked when it was created, picked from the same permission catalogue as roles.
  • A key reaches only the endpoints open to integrations: managing members, roles, the subscription and the account stays reserved to a human session.
  • A key is disabled or revoked from the screen that created it, and it takes effect immediately.

Going further

API keys

Create a key, choose its scopes, use it, revoke it.

Read the page

MCP server

Plug an AI agent into an organization, and what it can do.

Read the page

OpenAPI specifications

The interactive references are hosted on our own infrastructure. They list endpoints, parameters and responses, and let you try requests from the browser.

Product API

Public Elysia contract for the vault, invoicing, third parties, treasury, organizations and realtime.

Open the product APIhttps://www.react-box.com/api/v1/openapi

Authentication API

Better-Auth contract for sessions, the user account, organizations and the auth plugins.

Open the auth APIhttps://www.react-box.com/api/auth/reference

Connecting a third-party app

An AI agent already takes this path: the MCP server exposes a full OAuth 2.1 flow, with a consent screen where the organization is picked. The same plumbing will open authorization to ordinary third-party apps; until then, an organization API key covers server-to-server integrations.

  1. 1

    Register your app

    We register your application. You receive a client id and declare your redirect URLs.

  2. 2

    Redirect the user

    Your app redirects to the React Box authorization URL, with your client id and redirect URL.

  3. 3

    Consent

    The user signs in to React Box, picks the organization involved, and agrees to let your app act on their behalf.

  4. 4

    Back to your app

    React Box redirects to your declared URL with a single-use authorization code.

  5. 5

    Exchange the code

    Your server exchanges that code for an access token, which then authenticates every call.

The target protocol is OAuth 2.1, compatible with most existing libraries. Integration details will be documented here once the flow opens.

Versions

This documentation covers v1. Breaking changes will ship under a new major version, with reasonable notice before the previous one is retired.

Request access

Registering a third-party app is manual for now. Tell us about your product, your redirect URL and the data you need: contact@react-box.com