Tcl Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Tcl

load ./chilkat.dll

set success 0

#  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
#  See Global Unlock Sample.
#  Guide: Box API Guide.

set success 0

set curl [new_CkHttpCurl]

CkHttpCurl_SetVar $curl "client_id" "BOX_CLIENT_ID"
CkHttpCurl_SetVar $curl "client_secret" "BOX_CLIENT_SECRET"
CkHttpCurl_SetVar $curl "enterprise_id" "BOX_ENTERPRISE_ID"
#  enterprise identifies the app's service account. This is not an admin-user token.
CkHttpCurl_ClearTargetOutput $curl "*"
CkHttpCurl_ClearVar $curl "access_token"
CkHttpCurl_AddTargetOutput $curl "access_token" "access_token"
set success [CkHttpCurl_DoYourThing $curl "curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=client_credentials\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"box_subject_type=enterprise\" --data-urlencode \"box_subject_id={{enterprise_id}}\""]
if {expr [$success != 1]  ||  [[CkHttpCurl_get_StatusCode $curl] != 200]} then {
    puts "Box request failed. HTTP status: [CkHttpCurl_get_StatusCode $curl]"
    puts "Failure reason: [CkHttpCurl_get_FailReason $curl]"
    delete_CkHttpCurl $curl
    exit
}

if {[CkHttpCurl_VarDefined $curl "!"] != 1} then {
    puts "Expected response fields are missing."
    delete_CkHttpCurl $curl
    exit
}

#  Keep this token in protected application memory; reacquire it when it expires.
#  Do not print tokens or the complete token response.
puts "Service-account access token obtained."
CkHttpCurl_ClearTargetOutput $curl "*"
set authorizedCommand1 [new_CkStringBuilder]

CkStringBuilder_SetString $authorizedCommand1 "curl -X GET \"https://api.box.com/2.0/users/me?fields=id,name,login\" -H \"Authorization: Bearer {{access_token}}\""
set headerReplacement1 [CkStringBuilder_Replace $authorizedCommand1 "{{access_token}}" [CkHttpCurl_getVar $curl "access_token"]]
set success [CkHttpCurl_DoYourThing $curl [CkStringBuilder_getAsString $authorizedCommand1]]
if {expr [$success != 1]  ||  [[CkHttpCurl_get_StatusCode $curl] != 200]} then {
    puts "Box request failed. HTTP status: [CkHttpCurl_get_StatusCode $curl]"
    puts "Failure reason: [CkHttpCurl_get_FailReason $curl]"
    puts [CkHttpCurl_responseBodyStr $curl]
    delete_CkHttpCurl $curl
    delete_CkStringBuilder $authorizedCommand1
    exit
}

puts [CkHttpCurl_responseBodyStr $curl]

delete_CkHttpCurl $curl
delete_CkStringBuilder $authorizedCommand1