Delphi ActiveX Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Delphi ActiveX

var
success: Integer;
config: TChilkatJsonObject;
key: TPrivateKey;
header: TChilkatJsonObject;
jwt: TChilkatJwt;
prng: TChilkatPrng;
nonce: WideString;
claims: TChilkatJsonObject;
assertion: WideString;
curl: TChilkatHttpCurl;

begin
success := 0;

//  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

success := 0;

config := TChilkatJsonObject.Create(Self);
success := config.LoadFile('qa_data/tokens/box_jwt_config.json');
if (success <> 1) then
  begin
    Memo1.Lines.Add(config.LastErrorText);
    Exit;
  end;
key := TPrivateKey.Create(Self);
success := key.LoadEncryptedPem(config.StringOf('boxAppSettings.appAuth.privateKey'),config.StringOf('boxAppSettings.appAuth.passphrase'));
if (success <> 1) then
  begin
    Memo1.Lines.Add(key.LastErrorText);
    Exit;
  end;
header := TChilkatJsonObject.Create(Self);
header.UpdateString('alg','RS256');
header.UpdateString('typ','JWT');
header.UpdateString('kid',config.StringOf('boxAppSettings.appAuth.publicKeyID'));
jwt := TChilkatJwt.Create(Self);
prng := TChilkatPrng.Create(Self);
nonce := prng.GenRandom(32,'hex');
if (prng.LastMethodSuccess <> 1) then
  begin
    Memo1.Lines.Add(prng.LastErrorText);
    Exit;
  end;
claims := TChilkatJsonObject.Create(Self);
claims.UpdateString('iss',config.StringOf('boxAppSettings.clientID'));
claims.UpdateString('sub',config.StringOf('enterpriseID'));
claims.UpdateString('box_sub_type','enterprise');
claims.UpdateString('aud','https://api.box.com/oauth2/token');
claims.UpdateString('jti',nonce);
claims.UpdateInt('exp',jwt.GenNumericDate(45));
assertion := jwt.CreateJwtPk(header.Emit(),claims.Emit(),key.ControlInterface);
if (jwt.LastMethodSuccess <> 1) then
  begin
    Memo1.Lines.Add(jwt.LastErrorText);
    Exit;
  end;
curl := TChilkatHttpCurl.Create(Self);
curl.SetVar('client_id',config.StringOf('boxAppSettings.clientID'));
curl.SetVar('client_secret',config.StringOf('boxAppSettings.clientSecret'));
curl.SetVar('assertion',assertion);
curl.ClearTargetOutput('*');
curl.ClearVar('access_token');
curl.AddTargetOutput('access_token','access_token');
success := curl.DoYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "assertion={{assertion}}"');
if ((success <> 1) or (curl.StatusCode <> 200)) then
  begin
    Memo1.Lines.Add('Box request failed. HTTP status: ' + IntToStr(curl.StatusCode));
    Memo1.Lines.Add('Failure reason: ' + IntToStr(curl.FailReason));
    Exit;
  end;
if (curl.VarDefined('!') <> 1) then
  begin
    Memo1.Lines.Add('Expected response fields are missing.');
    Exit;
  end;
//  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
//  a new assertion/token request, not by using a refresh token.
Memo1.Lines.Add('JWT access token obtained.');