Go Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Go

    success := false

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = false

    config := chilkat.NewJsonObject()
    success = config.LoadFile("qa_data/tokens/box_jwt_config.json")
    if success != true {
        fmt.Println(config.LastErrorText())
        config.DisposeJsonObject()
        return
    }

    key := chilkat.NewPrivateKey()
    success = key.LoadEncryptedPem(*config.StringOf("boxAppSettings.appAuth.privateKey"),*config.StringOf("boxAppSettings.appAuth.passphrase"))
    if success != true {
        fmt.Println(key.LastErrorText())
        config.DisposeJsonObject()
        key.DisposePrivateKey()
        return
    }

    header := chilkat.NewJsonObject()
    header.UpdateString("alg","RS256")
    header.UpdateString("typ","JWT")
    header.UpdateString("kid",*config.StringOf("boxAppSettings.appAuth.publicKeyID"))
    jwt := chilkat.NewJwt()
    prng := chilkat.NewPrng()
    nonce := prng.GenRandom(32,"hex")
    if prng.LastMethodSuccess() != true {
        fmt.Println(prng.LastErrorText())
        config.DisposeJsonObject()
        key.DisposePrivateKey()
        header.DisposeJsonObject()
        jwt.DisposeJwt()
        prng.DisposePrng()
        return
    }

    claims := chilkat.NewJsonObject()
    claims.UpdateString("iss",*config.StringOf("boxAppSettings.clientID"))
    claims.UpdateString("sub",*config.StringOf("enterpriseID"))
    claims.UpdateString("box_sub_type","enterprise")
    claims.UpdateString("aud","https://api.box.com/oauth2/token")
    claims.UpdateString("jti",*nonce)
    claims.UpdateInt("exp",*jwt.GenNumericDate(45))
    assertion := jwt.CreateJwtPk(*header.Emit(),*claims.Emit(),key)
    if jwt.LastMethodSuccess() != true {
        fmt.Println(jwt.LastErrorText())
        config.DisposeJsonObject()
        key.DisposePrivateKey()
        header.DisposeJsonObject()
        jwt.DisposeJwt()
        prng.DisposePrng()
        claims.DisposeJsonObject()
        return
    }

    curl := chilkat.NewHttpCurl()
    curl.SetVar("client_id",*config.StringOf("boxAppSettings.clientID"))
    curl.SetVar("client_secret",*config.StringOf("boxAppSettings.clientSecret"))
    curl.SetVar("assertion",*assertion)
    curl.ClearTargetOutput("*")
    curl.ClearVar("access_token")
    curl.AddTargetOutput("access_token","access_token")
    success = curl.DoYourThing("curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"")
    if (success != true) || (curl.StatusCode() != 200) {
        fmt.Println("Box request failed. HTTP status: ", curl.StatusCode())
        fmt.Println("Failure reason: ", curl.FailReason())
        config.DisposeJsonObject()
        key.DisposePrivateKey()
        header.DisposeJsonObject()
        jwt.DisposeJwt()
        prng.DisposePrng()
        claims.DisposeJsonObject()
        curl.DisposeHttpCurl()
        return
    }

    if curl.VarDefined("!") != true {
        fmt.Println("Expected response fields are missing.")
        config.DisposeJsonObject()
        key.DisposePrivateKey()
        header.DisposeJsonObject()
        jwt.DisposeJwt()
        prng.DisposePrng()
        claims.DisposeJsonObject()
        curl.DisposeHttpCurl()
        return
    }

    //  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
    //  a new assertion/token request, not by using a refresh token.
    fmt.Println("JWT access token obtained.")

    config.DisposeJsonObject()
    key.DisposePrivateKey()
    header.DisposeJsonObject()
    jwt.DisposeJwt()
    prng.DisposePrng()
    claims.DisposeJsonObject()
    curl.DisposeHttpCurl()