PowerShell Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

PowerShell

Add-Type -Path "C:\chilkat\ChilkatDotNet47-x64\ChilkatDotNet47.dll"

$success = $false

#  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
#  See Global Unlock Sample.
#  Guide: Box API Guide.

$success = $false

$config = New-Object Chilkat.JsonObject
$success = $config.LoadFile("qa_data/tokens/box_jwt_config.json")
if ($success -ne $true) {
    $($config.LastErrorText)
    exit
}

$key = New-Object Chilkat.PrivateKey
$success = $key.LoadEncryptedPem($config.StringOf("boxAppSettings.appAuth.privateKey"),$config.StringOf("boxAppSettings.appAuth.passphrase"))
if ($success -ne $true) {
    $($key.LastErrorText)
    exit
}

$header = New-Object Chilkat.JsonObject
$header.UpdateString("alg","RS256")
$header.UpdateString("typ","JWT")
$header.UpdateString("kid",$config.StringOf("boxAppSettings.appAuth.publicKeyID"))
$jwt = New-Object Chilkat.Jwt
$prng = New-Object Chilkat.Prng
$nonce = $prng.GenRandom(32,"hex")
if ($prng.LastMethodSuccess -ne $true) {
    $($prng.LastErrorText)
    exit
}

$claims = New-Object Chilkat.JsonObject
$claims.UpdateString("iss",$config.StringOf("boxAppSettings.clientID"))
$claims.UpdateString("sub",$config.StringOf("enterpriseID"))
$claims.UpdateString("box_sub_type","enterprise")
$claims.UpdateString("aud","https://api.box.com/oauth2/token")
$claims.UpdateString("jti",$nonce)
$claims.UpdateInt("exp",$jwt.GenNumericDate(45))
$assertion = $jwt.CreateJwtPk($header.Emit(),$claims.Emit(),$key)
if ($jwt.LastMethodSuccess -ne $true) {
    $($jwt.LastErrorText)
    exit
}

$curl = New-Object Chilkat.HttpCurl
$curl.SetVar("client_id",$config.StringOf("boxAppSettings.clientID"))
$curl.SetVar("client_secret",$config.StringOf("boxAppSettings.clientSecret"))
$curl.SetVar("assertion",$assertion)
$curl.ClearTargetOutput("*")
$curl.ClearVar("access_token")
$curl.AddTargetOutput("access_token","access_token")
$success = $curl.DoYourThing("curl -X POST `"https://api.box.com/oauth2/token`" --data-urlencode `"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`" --data-urlencode `"client_id={{client_id}}`" --data-urlencode `"client_secret={{client_secret}}`" --data-urlencode `"assertion={{assertion}}`"")
if (($success -ne $true) -or ($curl.StatusCode -ne 200)) {
    $("Box request failed. HTTP status: " + $curl.StatusCode)
    $("Failure reason: " + $curl.FailReason)
    exit
}

if ($curl.VarDefined("!") -ne $true) {
    $("Expected response fields are missing.")
    exit
}

#  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
#  a new assertion/token request, not by using a refresh token.
$("JWT access token obtained.")