PHP Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Chilkat2 PHP

<?php

use Chilkat2\HttpCurl;
use Chilkat2\StringBuilder;

$success = false;

// Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
// See Global Unlock Sample.
// Guide: Box API Guide.

$success = false;

$curl = new HttpCurl();
$curl->SetVar('client_id', 'BOX_CLIENT_ID');
$curl->SetVar('client_secret', 'BOX_CLIENT_SECRET');
$curl->SetVar('enterprise_id', 'BOX_ENTERPRISE_ID');
// enterprise identifies the app's service account. This is not an admin-user token.
$curl->ClearTargetOutput('*');
$curl->ClearVar('access_token');
$curl->AddTargetOutput('access_token', 'access_token');
try {
    $curl->DoYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=client_credentials" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "box_subject_type=enterprise" --data-urlencode "box_subject_id={{enterprise_id}}"');
    $success = true;
} catch (\Chilkat2\Exception $e) {
    $success = false;
}
if ((!$success) || ($curl->StatusCode != 200)) {
    echo 'Box request failed. HTTP status: ', $curl->StatusCode, "\n";
    echo 'Failure reason: ', $curl->FailReason, "\n";
    exit;
}

if (!$curl->VarDefined('!')) {
    echo "Expected response fields are missing.\n";
    exit;
}

// Keep this token in protected application memory; reacquire it when it expires.
// Do not print tokens or the complete token response.
echo "Service-account access token obtained.\n";
$curl->ClearTargetOutput('*');
$authorizedCommand1 = new StringBuilder();
$authorizedCommand1->SetString('curl -X GET "https://api.box.com/2.0/users/me?fields=id,name,login" -H "Authorization: Bearer {{access_token}}"');
$headerReplacement1 = $authorizedCommand1->Replace('{{access_token}}', $curl->GetVar('access_token'));
try {
    $curl->DoYourThing($authorizedCommand1->GetAsString());
    $success = true;
} catch (\Chilkat2\Exception $e) {
    $success = false;
}
if ((!$success) || ($curl->StatusCode != 200)) {
    echo 'Box request failed. HTTP status: ', $curl->StatusCode, "\n";
    echo 'Failure reason: ', $curl->FailReason, "\n";
    echo $curl->ResponseBodyStr, "\n";
    exit;
}

echo $curl->ResponseBodyStr, "\n";