Perl Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Chilkat2 Perl

use strict;
use warnings;
use Chilkat2;

# Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
# See Global Unlock Sample.
# Guide: Box API Guide.

my $success = 0;

my $config = Chilkat2::JsonObject->new;
$success = $config->LoadFile('qa_data/tokens/box_jwt_config.json');
if (!$success) {
    print $config->LastErrorText, "\n";
    exit;
}

my $key = Chilkat2::PrivateKey->new;
$success = $key->LoadEncryptedPem($config->StringOf('boxAppSettings.appAuth.privateKey'), $config->StringOf('boxAppSettings.appAuth.passphrase'));
if (!$success) {
    print $key->LastErrorText, "\n";
    exit;
}

my $header = Chilkat2::JsonObject->new;
$header->UpdateString('alg', 'RS256');
$header->UpdateString('typ', 'JWT');
$header->UpdateString('kid', $config->StringOf('boxAppSettings.appAuth.publicKeyID'));
my $jwt = Chilkat2::Jwt->new;
my $prng = Chilkat2::Prng->new;
my $nonce = $prng->GenRandom(32, 'hex');
if (!$prng->LastMethodSuccess) {
    print $prng->LastErrorText, "\n";
    exit;
}

my $claims = Chilkat2::JsonObject->new;
$claims->UpdateString('iss', $config->StringOf('boxAppSettings.clientID'));
$claims->UpdateString('sub', $config->StringOf('enterpriseID'));
$claims->UpdateString('box_sub_type', 'enterprise');
$claims->UpdateString('aud', 'https://api.box.com/oauth2/token');
$claims->UpdateString('jti', $nonce);
$claims->UpdateInt('exp', $jwt->GenNumericDate(45));
my $assertion = $jwt->CreateJwtPk($header->Emit(), $claims->Emit(), $key);
if (!$jwt->LastMethodSuccess) {
    print $jwt->LastErrorText, "\n";
    exit;
}

my $curl = Chilkat2::HttpCurl->new;
$curl->SetVar('client_id', $config->StringOf('boxAppSettings.clientID'));
$curl->SetVar('client_secret', $config->StringOf('boxAppSettings.clientSecret'));
$curl->SetVar('assertion', $assertion);
$curl->ClearTargetOutput('*');
$curl->ClearVar('access_token');
$curl->AddTargetOutput('access_token', 'access_token');
$success = $curl->DoYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "assertion={{assertion}}"');
if ((!$success) || ($curl->StatusCode != 200)) {
    print 'Box request failed. HTTP status: ', $curl->StatusCode, "\n";
    print 'Failure reason: ', $curl->FailReason, "\n";
    exit;
}

if (!$curl->VarDefined('!')) {
    print "Expected response fields are missing.\n";
    exit;
}

# Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
# a new assertion/token request, not by using a refresh token.
print "JWT access token obtained.\n";