Python Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Chilkat2-Python

import sys
import chilkat2

success = False

# Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
# See Global Unlock Sample.
# Guide: Box API Guide.

success = False

config = chilkat2.JsonObject()
success = config.LoadFile("qa_data/tokens/box_jwt_config.json")
if (success != True):
    print(config.LastErrorText)
    sys.exit()

key = chilkat2.PrivateKey()
success = key.LoadEncryptedPem(config.StringOf("boxAppSettings.appAuth.privateKey"),config.StringOf("boxAppSettings.appAuth.passphrase"))
if (success != True):
    print(key.LastErrorText)
    sys.exit()

header = chilkat2.JsonObject()
header.UpdateString("alg","RS256")
header.UpdateString("typ","JWT")
header.UpdateString("kid",config.StringOf("boxAppSettings.appAuth.publicKeyID"))
jwt = chilkat2.Jwt()
prng = chilkat2.Prng()
nonce = prng.GenRandom(32,"hex")
if (prng.LastMethodSuccess != True):
    print(prng.LastErrorText)
    sys.exit()

claims = chilkat2.JsonObject()
claims.UpdateString("iss",config.StringOf("boxAppSettings.clientID"))
claims.UpdateString("sub",config.StringOf("enterpriseID"))
claims.UpdateString("box_sub_type","enterprise")
claims.UpdateString("aud","https://api.box.com/oauth2/token")
claims.UpdateString("jti",nonce)
claims.UpdateInt("exp",jwt.GenNumericDate(45))
assertion = jwt.CreateJwtPk(header.Emit(),claims.Emit(),key)
if (jwt.LastMethodSuccess != True):
    print(jwt.LastErrorText)
    sys.exit()

curl = chilkat2.HttpCurl()
curl.SetVar("client_id",config.StringOf("boxAppSettings.clientID"))
curl.SetVar("client_secret",config.StringOf("boxAppSettings.clientSecret"))
curl.SetVar("assertion",assertion)
curl.ClearTargetOutput("*")
curl.ClearVar("access_token")
curl.AddTargetOutput("access_token","access_token")
success = curl.DoYourThing("curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"")
if ((success != True) or (curl.StatusCode != 200)):
    print("Box request failed. HTTP status: " + str(curl.StatusCode))
    print("Failure reason: " + str(curl.FailReason))
    sys.exit()

if (curl.VarDefined("!") != True):
    print("Expected response fields are missing.")
    sys.exit()

# Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
# a new assertion/token request, not by using a refresh token.
print("JWT access token obtained.")