Boxpressd uses two credentials with separate purposes.
Developer keys
Send your application key in the x-boxpressd-key header:
Create, rotate, and revoke keys in your application’s Credentials page at developers.boxpressd.com. Development keys use the bxp_test_ prefix. Production keys require an approved application when production approval is enabled.
The full key appears only when you create or rotate it. Rotating a key revokes the prior key immediately.
A developer key is an application-wide secret. Keep it on a backend or backend-for-frontend. Native and browser bundles cannot protect it.
OAuth access tokens
For connected-user requests, include the developer key and the user’s Bearer token:
For example, GET /v1/me requires profile:read. Its email field appears only when the token also has email:read.
See OAuth for Authorization Code + PKCE setup and the current scope list.
Rate limits
The default application policy sustains 60 requests per minute with a burst capacity of 20. Your plan or application can override this policy.
REST responses include ratelimit-limit and ratelimit-remaining. A 429 response also includes retry-after.
Authentication errors
