Unicode C Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Unicode C

#include <C_CkJsonObjectW.h>
#include <C_CkPrivateKeyW.h>
#include <C_CkJwtW.h>
#include <C_CkPrngW.h>
#include <C_CkHttpCurlW.h>

void ChilkatSample(void)
    {
    BOOL success;
    HCkJsonObjectW config;
    HCkPrivateKeyW key;
    HCkJsonObjectW header;
    HCkJwtW jwt;
    HCkPrngW prng;
    const wchar_t *nonce;
    HCkJsonObjectW claims;
    const wchar_t *assertion;
    HCkHttpCurlW curl;

    success = FALSE;

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = FALSE;

    config = CkJsonObjectW_Create();
    success = CkJsonObjectW_LoadFile(config,L"qa_data/tokens/box_jwt_config.json");
    if (success != TRUE) {
        wprintf(L"%s\n",CkJsonObjectW_lastErrorText(config));
        CkJsonObjectW_Dispose(config);
        return;
    }

    key = CkPrivateKeyW_Create();
    success = CkPrivateKeyW_LoadEncryptedPem(key,CkJsonObjectW_stringOf(config,L"boxAppSettings.appAuth.privateKey"),CkJsonObjectW_stringOf(config,L"boxAppSettings.appAuth.passphrase"));
    if (success != TRUE) {
        wprintf(L"%s\n",CkPrivateKeyW_lastErrorText(key));
        CkJsonObjectW_Dispose(config);
        CkPrivateKeyW_Dispose(key);
        return;
    }

    header = CkJsonObjectW_Create();
    CkJsonObjectW_UpdateString(header,L"alg",L"RS256");
    CkJsonObjectW_UpdateString(header,L"typ",L"JWT");
    CkJsonObjectW_UpdateString(header,L"kid",CkJsonObjectW_stringOf(config,L"boxAppSettings.appAuth.publicKeyID"));
    jwt = CkJwtW_Create();
    prng = CkPrngW_Create();
    nonce = CkPrngW_genRandom(prng,32,L"hex");
    if (CkPrngW_getLastMethodSuccess(prng) != TRUE) {
        wprintf(L"%s\n",CkPrngW_lastErrorText(prng));
        CkJsonObjectW_Dispose(config);
        CkPrivateKeyW_Dispose(key);
        CkJsonObjectW_Dispose(header);
        CkJwtW_Dispose(jwt);
        CkPrngW_Dispose(prng);
        return;
    }

    claims = CkJsonObjectW_Create();
    CkJsonObjectW_UpdateString(claims,L"iss",CkJsonObjectW_stringOf(config,L"boxAppSettings.clientID"));
    CkJsonObjectW_UpdateString(claims,L"sub",CkJsonObjectW_stringOf(config,L"enterpriseID"));
    CkJsonObjectW_UpdateString(claims,L"box_sub_type",L"enterprise");
    CkJsonObjectW_UpdateString(claims,L"aud",L"https://api.box.com/oauth2/token");
    CkJsonObjectW_UpdateString(claims,L"jti",nonce);
    CkJsonObjectW_UpdateInt(claims,L"exp",CkJwtW_GenNumericDate(jwt,45));
    assertion = CkJwtW_createJwtPk(jwt,CkJsonObjectW_emit(header),CkJsonObjectW_emit(claims),key);
    if (CkJwtW_getLastMethodSuccess(jwt) != TRUE) {
        wprintf(L"%s\n",CkJwtW_lastErrorText(jwt));
        CkJsonObjectW_Dispose(config);
        CkPrivateKeyW_Dispose(key);
        CkJsonObjectW_Dispose(header);
        CkJwtW_Dispose(jwt);
        CkPrngW_Dispose(prng);
        CkJsonObjectW_Dispose(claims);
        return;
    }

    curl = CkHttpCurlW_Create();
    CkHttpCurlW_SetVar(curl,L"client_id",CkJsonObjectW_stringOf(config,L"boxAppSettings.clientID"));
    CkHttpCurlW_SetVar(curl,L"client_secret",CkJsonObjectW_stringOf(config,L"boxAppSettings.clientSecret"));
    CkHttpCurlW_SetVar(curl,L"assertion",assertion);
    CkHttpCurlW_ClearTargetOutput(curl,L"*");
    CkHttpCurlW_ClearVar(curl,L"access_token");
    CkHttpCurlW_AddTargetOutput(curl,L"access_token",L"access_token");
    success = CkHttpCurlW_DoYourThing(curl,L"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"");
    if ((success != TRUE) || (CkHttpCurlW_getStatusCode(curl) != 200)) {
        wprintf(L"Box request failed. HTTP status: %d\n",CkHttpCurlW_getStatusCode(curl));
        wprintf(L"Failure reason: %d\n",CkHttpCurlW_getFailReason(curl));
        CkJsonObjectW_Dispose(config);
        CkPrivateKeyW_Dispose(key);
        CkJsonObjectW_Dispose(header);
        CkJwtW_Dispose(jwt);
        CkPrngW_Dispose(prng);
        CkJsonObjectW_Dispose(claims);
        CkHttpCurlW_Dispose(curl);
        return;
    }

    if (CkHttpCurlW_VarDefined(curl,L"!") != TRUE) {
        wprintf(L"Expected response fields are missing.\n");
        CkJsonObjectW_Dispose(config);
        CkPrivateKeyW_Dispose(key);
        CkJsonObjectW_Dispose(header);
        CkJwtW_Dispose(jwt);
        CkPrngW_Dispose(prng);
        CkJsonObjectW_Dispose(claims);
        CkHttpCurlW_Dispose(curl);
        return;
    }

    //  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
    //  a new assertion/token request, not by using a refresh token.
    wprintf(L"JWT access token obtained.\n");


    CkJsonObjectW_Dispose(config);
    CkPrivateKeyW_Dispose(key);
    CkJsonObjectW_Dispose(header);
    CkJwtW_Dispose(jwt);
    CkPrngW_Dispose(prng);
    CkJsonObjectW_Dispose(claims);
    CkHttpCurlW_Dispose(curl);

    }