Lua Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Lua

local chilkat = require("chilkat")

-- Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
-- See Global Unlock Sample.
-- Guide: Box API Guide.

local success = false

local curl = chilkat.HttpCurl.new()
curl:set_var("client_id", "BOX_CLIENT_ID")
curl:set_var("client_secret", "BOX_CLIENT_SECRET")
curl:set_var("enterprise_id", "BOX_ENTERPRISE_ID")
-- enterprise identifies the app's service account. This is not an admin-user token.
curl:clear_target_output("*")
curl:clear_var("access_token")
curl:add_target_output("access_token", "access_token")
success = curl:do_your_thing("curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=client_credentials\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"box_subject_type=enterprise\" --data-urlencode \"box_subject_id={{enterprise_id}}\"")
if (not success) or (curl.status_code ~= 200) then
    print("Box request failed. HTTP status: " .. curl.status_code)
    print("Failure reason: " .. curl.fail_reason)
    return
end

if not curl:var_defined("!") then
    print("Expected response fields are missing.")
    return
end

-- Keep this token in protected application memory; reacquire it when it expires.
-- Do not print tokens or the complete token response.
print("Service-account access token obtained.")
curl:clear_target_output("*")
local authorizedCommand1 = chilkat.StringBuilder.new()
authorizedCommand1:set_string("curl -X GET \"https://api.box.com/2.0/users/me?fields=id,name,login\" -H \"Authorization: Bearer {{access_token}}\"")
local headerReplacement1 = authorizedCommand1:replace("{{access_token}}", curl:get_var("access_token"))
success = curl:do_your_thing(authorizedCommand1:get_as_string())
if (not success) or (curl.status_code ~= 200) then
    print("Box request failed. HTTP status: " .. curl.status_code)
    print("Failure reason: " .. curl.fail_reason)
    print(curl.response_body_str)
    return
end

print(curl.response_body_str)