Unicode C++ Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Unicode C++

#include <CkJsonObjectW.h>
#include <CkPrivateKeyW.h>
#include <CkJwtW.h>
#include <CkPrngW.h>
#include <CkHttpCurlW.h>

void ChilkatSample(void)
    {
    bool success = false;

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = false;

    CkJsonObjectW config;
    success = config.LoadFile(L"qa_data/tokens/box_jwt_config.json");
    if (success != true) {
        wprintf(L"%s\n",config.lastErrorText());
        return;
    }

    CkPrivateKeyW key;
    success = key.LoadEncryptedPem(config.stringOf(L"boxAppSettings.appAuth.privateKey"),config.stringOf(L"boxAppSettings.appAuth.passphrase"));
    if (success != true) {
        wprintf(L"%s\n",key.lastErrorText());
        return;
    }

    CkJsonObjectW header;
    header.UpdateString(L"alg",L"RS256");
    header.UpdateString(L"typ",L"JWT");
    header.UpdateString(L"kid",config.stringOf(L"boxAppSettings.appAuth.publicKeyID"));
    CkJwtW jwt;
    CkPrngW prng;
    const wchar_t *nonce = prng.genRandom(32,L"hex");
    if (prng.get_LastMethodSuccess() != true) {
        wprintf(L"%s\n",prng.lastErrorText());
        return;
    }

    CkJsonObjectW claims;
    claims.UpdateString(L"iss",config.stringOf(L"boxAppSettings.clientID"));
    claims.UpdateString(L"sub",config.stringOf(L"enterpriseID"));
    claims.UpdateString(L"box_sub_type",L"enterprise");
    claims.UpdateString(L"aud",L"https://api.box.com/oauth2/token");
    claims.UpdateString(L"jti",nonce);
    claims.UpdateInt(L"exp",jwt.GenNumericDate(45));
    const wchar_t *assertion = jwt.createJwtPk(header.emit(),claims.emit(),key);
    if (jwt.get_LastMethodSuccess() != true) {
        wprintf(L"%s\n",jwt.lastErrorText());
        return;
    }

    CkHttpCurlW curl;
    curl.SetVar(L"client_id",config.stringOf(L"boxAppSettings.clientID"));
    curl.SetVar(L"client_secret",config.stringOf(L"boxAppSettings.clientSecret"));
    curl.SetVar(L"assertion",assertion);
    curl.ClearTargetOutput(L"*");
    curl.ClearVar(L"access_token");
    curl.AddTargetOutput(L"access_token",L"access_token");
    success = curl.DoYourThing(L"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"");
    if ((success != true) || (curl.get_StatusCode() != 200)) {
        wprintf(L"Box request failed. HTTP status: %d\n",curl.get_StatusCode());
        wprintf(L"Failure reason: %d\n",curl.get_FailReason());
        return;
    }

    if (curl.VarDefined(L"!") != true) {
        wprintf(L"Expected response fields are missing.\n");
        return;
    }

    //  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
    //  a new assertion/token request, not by using a refresh token.
    wprintf(L"JWT access token obtained.\n");
    }