Objective-C Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Objective-C

#import <CkoJsonObject.h>
#import <CkoPrivateKey.h>
#import <CkoJwt.h>
#import <CkoPrng.h>
#import <NSString.h>
#import <CkoHttpCurl.h>

BOOL success = NO;

//  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

success = NO;

CkoJsonObject *config = [[CkoJsonObject alloc] init];
success = [config LoadFile: @"qa_data/tokens/box_jwt_config.json"];
if (success != YES) {
    NSLog(@"%@",config.LastErrorText);
    return;
}

CkoPrivateKey *key = [[CkoPrivateKey alloc] init];
success = [key LoadEncryptedPem: [config StringOf: @"boxAppSettings.appAuth.privateKey"] password: [config StringOf: @"boxAppSettings.appAuth.passphrase"]];
if (success != YES) {
    NSLog(@"%@",key.LastErrorText);
    return;
}

CkoJsonObject *header = [[CkoJsonObject alloc] init];
[header UpdateString: @"alg" value: @"RS256"];
[header UpdateString: @"typ" value: @"JWT"];
[header UpdateString: @"kid" value: [config StringOf: @"boxAppSettings.appAuth.publicKeyID"]];
CkoJwt *jwt = [[CkoJwt alloc] init];
CkoPrng *prng = [[CkoPrng alloc] init];
NSString *nonce = [prng GenRandom: [NSNumber numberWithInt: 32] encoding: @"hex"];
if (prng.LastMethodSuccess != YES) {
    NSLog(@"%@",prng.LastErrorText);
    return;
}

CkoJsonObject *claims = [[CkoJsonObject alloc] init];
[claims UpdateString: @"iss" value: [config StringOf: @"boxAppSettings.clientID"]];
[claims UpdateString: @"sub" value: [config StringOf: @"enterpriseID"]];
[claims UpdateString: @"box_sub_type" value: @"enterprise"];
[claims UpdateString: @"aud" value: @"https://api.box.com/oauth2/token"];
[claims UpdateString: @"jti" value: nonce];
[claims UpdateInt: @"exp" value: [jwt GenNumericDate: [NSNumber numberWithInt: 45]]];
NSString *assertion = [jwt CreateJwtPk: [header Emit] payload: [claims Emit] key: key];
if (jwt.LastMethodSuccess != YES) {
    NSLog(@"%@",jwt.LastErrorText);
    return;
}

CkoHttpCurl *curl = [[CkoHttpCurl alloc] init];
[curl SetVar: @"client_id" varValue: [config StringOf: @"boxAppSettings.clientID"]];
[curl SetVar: @"client_secret" varValue: [config StringOf: @"boxAppSettings.clientSecret"]];
[curl SetVar: @"assertion" varValue: assertion];
[curl ClearTargetOutput: @"*"];
[curl ClearVar: @"access_token"];
[curl AddTargetOutput: @"access_token" varName: @"access_token"];
success = [curl DoYourThing: @"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\""];
if ((success != YES) || ([curl.StatusCode intValue] != 200)) {
    NSLog(@"%@%d",@"Box request failed. HTTP status: ",[curl.StatusCode intValue]);
    NSLog(@"%@%d",@"Failure reason: ",[curl.FailReason intValue]);
    return;
}

if ([curl VarDefined: @"!"] != YES) {
    NSLog(@"%@",@"Expected response fields are missing.");
    return;
}

//  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
//  a new assertion/token request, not by using a refresh token.
NSLog(@"%@",@"JWT access token obtained.");