Unicode C Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Unicode C

#include <C_CkHttpCurlW.h>
#include <C_CkStringBuilderW.h>

void ChilkatSample(void)
    {
    BOOL success;
    HCkHttpCurlW curl;
    HCkStringBuilderW authorizedCommand1;
    int headerReplacement1;

    success = FALSE;

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = FALSE;

    curl = CkHttpCurlW_Create();
    CkHttpCurlW_SetVar(curl,L"client_id",L"BOX_CLIENT_ID");
    CkHttpCurlW_SetVar(curl,L"client_secret",L"BOX_CLIENT_SECRET");
    CkHttpCurlW_SetVar(curl,L"enterprise_id",L"BOX_ENTERPRISE_ID");
    //  enterprise identifies the app's service account. This is not an admin-user token.
    CkHttpCurlW_ClearTargetOutput(curl,L"*");
    CkHttpCurlW_ClearVar(curl,L"access_token");
    CkHttpCurlW_AddTargetOutput(curl,L"access_token",L"access_token");
    success = CkHttpCurlW_DoYourThing(curl,L"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=client_credentials\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"box_subject_type=enterprise\" --data-urlencode \"box_subject_id={{enterprise_id}}\"");
    if ((success != TRUE) || (CkHttpCurlW_getStatusCode(curl) != 200)) {
        wprintf(L"Box request failed. HTTP status: %d\n",CkHttpCurlW_getStatusCode(curl));
        wprintf(L"Failure reason: %d\n",CkHttpCurlW_getFailReason(curl));
        CkHttpCurlW_Dispose(curl);
        return;
    }

    if (CkHttpCurlW_VarDefined(curl,L"!") != TRUE) {
        wprintf(L"Expected response fields are missing.\n");
        CkHttpCurlW_Dispose(curl);
        return;
    }

    //  Keep this token in protected application memory; reacquire it when it expires.
    //  Do not print tokens or the complete token response.
    wprintf(L"Service-account access token obtained.\n");
    CkHttpCurlW_ClearTargetOutput(curl,L"*");
    authorizedCommand1 = CkStringBuilderW_Create();
    CkStringBuilderW_SetString(authorizedCommand1,L"curl -X GET \"https://api.box.com/2.0/users/me?fields=id,name,login\" -H \"Authorization: Bearer {{access_token}}\"");
    headerReplacement1 = CkStringBuilderW_Replace(authorizedCommand1,L"{{access_token}}",CkHttpCurlW_getVar(curl,L"access_token"));
    success = CkHttpCurlW_DoYourThing(curl,CkStringBuilderW_getAsString(authorizedCommand1));
    if ((success != TRUE) || (CkHttpCurlW_getStatusCode(curl) != 200)) {
        wprintf(L"Box request failed. HTTP status: %d\n",CkHttpCurlW_getStatusCode(curl));
        wprintf(L"Failure reason: %d\n",CkHttpCurlW_getFailReason(curl));
        wprintf(L"%s\n",CkHttpCurlW_responseBodyStr(curl));
        CkHttpCurlW_Dispose(curl);
        CkStringBuilderW_Dispose(authorizedCommand1);
        return;
    }

    wprintf(L"%s\n",CkHttpCurlW_responseBodyStr(curl));


    CkHttpCurlW_Dispose(curl);
    CkStringBuilderW_Dispose(authorizedCommand1);

    }