Integrating React Box
An integration acts on behalf of your organization, with the rights you give it — and nothing else.
Updated on October 2, 2026
Four rules
They hold for any integration, whatever technology sits on the other side.
- A key acts for the organization, with the scopes it was given and never with the rights of the person who created it. It is still tied to that person's access: when they leave the organization, their keys stop working — so issue the ones that must last from an account that stays.
- A key carries only the scopes ticked when it was created, picked from the same permission catalogue as roles.
- A key reaches only the endpoints open to integrations: managing members, roles, the subscription and the account stays reserved to a human session.
- A key is disabled or revoked from the screen that created it, and it takes effect immediately.
Going further
OpenAPI specifications
The interactive references are hosted on our own infrastructure. They list endpoints, parameters and responses, and let you try requests from the browser.
Product API
Public Elysia contract for the vault, invoicing, third parties, treasury, organizations and realtime.
https://www.react-box.com/api/v1/openapiAuthentication API
Better-Auth contract for sessions, the user account, organizations and the auth plugins.
https://www.react-box.com/api/auth/referenceConnecting a third-party app
An AI agent already takes this path: the MCP server exposes a full OAuth 2.1 flow, with a consent screen where the organization is picked. The same plumbing will open authorization to ordinary third-party apps; until then, an organization API key covers server-to-server integrations.
Register your app
Your application registers itself, through the OAuth 2.1 dynamic registration endpoint named in our discovery document. It receives a client id and declares its redirect URLs; there is no manual step and no review on our side.
Redirect the user
Your app redirects to the React Box authorization URL, with your client id and redirect URL.
Consent
The user signs in to React Box, picks the organization involved, and agrees to let your app act on their behalf. The screen appears at every authorization — the organization is never inherited from a previous one — and it names your redirect URL, alongside a warning that the application is not vetted by us.
Back to your app
React Box redirects to your declared URL with a single-use authorization code.
Exchange the code
Your server exchanges that code for an access token, which then authenticates every call.
The target protocol is OAuth 2.1, compatible with most existing libraries. Integration details will be documented here once the flow opens.
Versions
This documentation covers v1. Breaking changes will ship under a new major version, with reasonable notice before the previous one is retired.
Get in touch