Dart Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Dart

import 'package:chilkat/chilkat.dart';

void main() {
  var success = false;

  // Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
  // See Global Unlock Sample.
  // Guide: Box API Guide.

  success = false;

  final config = CkJsonObject();
  try {
    config.loadFile('qa_data/tokens/box_jwt_config.json');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final key = CkPrivateKey();
  try {
    key.loadEncryptedPem(config.stringOf('boxAppSettings.appAuth.privateKey'), config.stringOf('boxAppSettings.appAuth.passphrase'));
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final header = CkJsonObject();
  header.updateString('alg', 'RS256');
  header.updateString('typ', 'JWT');
  header.updateString('kid', config.stringOf('boxAppSettings.appAuth.publicKeyID'));
  final jwt = CkJwt();
  final prng = CkPrng();
  final String nonce;
  try {
    nonce = prng.genRandom(32, 'hex');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final claims = CkJsonObject();
  claims.updateString('iss', config.stringOf('boxAppSettings.clientID'));
  claims.updateString('sub', config.stringOf('enterpriseID'));
  claims.updateString('box_sub_type', 'enterprise');
  claims.updateString('aud', 'https://api.box.com/oauth2/token');
  claims.updateString('jti', nonce);
  claims.updateInt('exp', jwt.genNumericDate(45));
  final String assertion;
  try {
    assertion = jwt.createJwtPk(header.emit(), claims.emit(), key);
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final curl = CkHttpCurl();
  curl.setVar('client_id', config.stringOf('boxAppSettings.clientID'));
  curl.setVar('client_secret', config.stringOf('boxAppSettings.clientSecret'));
  curl.setVar('assertion', assertion);
  curl.clearTargetOutput('*');
  curl.clearVar('access_token');
  curl.addTargetOutput('access_token', 'access_token');
  success = true;
  try {
    curl.doYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "assertion={{assertion}}"');
  } on ChilkatException {
    success = false;
  }
  if ((!success) || (curl.statusCode != 200)) {
    print('Box request failed. HTTP status: ${curl.statusCode}');
    print('Failure reason: ${curl.failReason}');
    return;
  }

  if (!curl.varDefined('!')) {
    print('Expected response fields are missing.');
    return;
  }

  // Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
  // a new assertion/token request, not by using a refresh token.
  print('JWT access token obtained.');
}