Lazarus Pascal Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Lazarus Pascal

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.StringBuilder,
  Chilkat.HttpCurl;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  curl: THttpCurl;
  authorizedCommand1: TStringBuilder;
  headerReplacement1: Integer;

begin
  success := False;

  //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
  //  See Global Unlock Sample.
  //  Guide: Box API Guide.

  success := False;

  curl := THttpCurl.Create;
  curl.SetVar('client_id','BOX_CLIENT_ID');
  curl.SetVar('client_secret','BOX_CLIENT_SECRET');
  curl.SetVar('enterprise_id','BOX_ENTERPRISE_ID');
  //  enterprise identifies the app's service account. This is not an admin-user token.
  curl.ClearTargetOutput('*');
  curl.ClearVar('access_token');
  curl.AddTargetOutput('access_token','access_token');
  success := curl.DoYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=client_credentials" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "box_subject_type=enterprise" --data-urlencode "box_subject_id={{enterprise_id}}"');
  if ((success <> True) or (curl.StatusCode <> 200)) then
    begin
      WriteLn('Box request failed. HTTP status: ' + curl.StatusCode);
      WriteLn('Failure reason: ' + curl.FailReason);
      Exit;
    end;
  if (curl.VarDefined('!') <> True) then
    begin
      WriteLn('Expected response fields are missing.');
      Exit;
    end;
  //  Keep this token in protected application memory; reacquire it when it expires.
  //  Do not print tokens or the complete token response.
  WriteLn('Service-account access token obtained.');
  curl.ClearTargetOutput('*');
  authorizedCommand1 := TStringBuilder.Create;
  authorizedCommand1.SetString('curl -X GET "https://api.box.com/2.0/users/me?fields=id,name,login" -H "Authorization: Bearer {{access_token}}"');
  headerReplacement1 := authorizedCommand1.Replace('{{access_token}}',curl.GetVar('access_token'));
  success := curl.DoYourThing(authorizedCommand1.GetAsString());
  if ((success <> True) or (curl.StatusCode <> 200)) then
    begin
      WriteLn('Box request failed. HTTP status: ' + curl.StatusCode);
      WriteLn('Failure reason: ' + curl.FailReason);
      WriteLn(curl.ResponseBodyStr);
      Exit;
    end;
  WriteLn(curl.ResponseBodyStr);


  curl.Free;
  authorizedCommand1.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.