B4X Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

B4X

Dim success As Boolean = False

'  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
'  See Global Unlock Sample.
'  Guide: Box API Guide.

success = False

Dim config As ChilkatJsonObject
config.Initialize
success = config.LoadFile("qa_data/tokens/box_jwt_config.json")
If success <> True Then
    Log(config.LastErrorText)
    Return
End If

Dim key As ChilkatPrivateKey
key.Initialize("key")
success = key.LoadEncryptedPem(config.StringOf("boxAppSettings.appAuth.privateKey"), config.StringOf("boxAppSettings.appAuth.passphrase"))
If success <> True Then
    Log(key.LastErrorText)
    Return
End If

Dim header As ChilkatJsonObject
header.Initialize
header.UpdateString("alg", "RS256")
header.UpdateString("typ", "JWT")
header.UpdateString("kid", config.StringOf("boxAppSettings.appAuth.publicKeyID"))
Dim jwt As ChilkatJwt
jwt.Initialize
Dim prng As ChilkatPrng
prng.Initialize
Dim nonce As String = prng.GenRandom(32, "hex")
If prng.LastMethodSuccess <> True Then
    Log(prng.LastErrorText)
    Return
End If

Dim claims As ChilkatJsonObject
claims.Initialize
claims.UpdateString("iss", config.StringOf("boxAppSettings.clientID"))
claims.UpdateString("sub", config.StringOf("enterpriseID"))
claims.UpdateString("box_sub_type", "enterprise")
claims.UpdateString("aud", "https://api.box.com/oauth2/token")
claims.UpdateString("jti", nonce)
claims.UpdateInt("exp", jwt.GenNumericDate(45))
Dim assertion As String = jwt.CreateJwtPk(header.Emit, claims.Emit, key)
If jwt.LastMethodSuccess <> True Then
    Log(jwt.LastErrorText)
    Return
End If

Dim curl As ChilkatHttpCurl
curl.Initialize("curl")
curl.SetVar("client_id", config.StringOf("boxAppSettings.clientID"))
curl.SetVar("client_secret", config.StringOf("boxAppSettings.clientSecret"))
curl.SetVar("assertion", assertion)
curl.ClearTargetOutput("*")
curl.ClearVar("access_token")
curl.AddTargetOutput("access_token", "access_token")
success = curl.DoYourThing("curl -X POST " & Chr(34) & "https://api.box.com/oauth2/token" & Chr(34) & " --data-urlencode " & Chr(34) & "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" & Chr(34) & " --data-urlencode " & Chr(34) & "client_id={{client_id}}" & Chr(34) & " --data-urlencode " & Chr(34) & "client_secret={{client_secret}}" & Chr(34) & " --data-urlencode " & Chr(34) & "assertion={{assertion}}" & Chr(34))
If (success <> True) Or (curl.StatusCode <> 200) Then
    Log("Box request failed. HTTP status: " & curl.StatusCode)
    Log("Failure reason: " & curl.FailReason)
    Return
End If

If curl.VarDefined("!") <> True Then
    Log("Expected response fields are missing.")
    Return
End If

'  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
'  a new assertion/token request, not by using a refresh token.
Log("JWT access token obtained.")