Classic ASP Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Classic ASP

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
success = 0

'  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
'  See Global Unlock Sample.
'  Guide: Box API Guide.

success = 0

set config = Server.CreateObject("Chilkat.JsonObject")
success = config.LoadFile("qa_data/tokens/box_jwt_config.json")
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( config.LastErrorText) & "</pre>"
    Response.End
End If

set key = Server.CreateObject("Chilkat.PrivateKey")
success = key.LoadEncryptedPem(config.StringOf("boxAppSettings.appAuth.privateKey"),config.StringOf("boxAppSettings.appAuth.passphrase"))
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( key.LastErrorText) & "</pre>"
    Response.End
End If

set header = Server.CreateObject("Chilkat.JsonObject")
success = header.UpdateString("alg","RS256")
success = header.UpdateString("typ","JWT")
success = header.UpdateString("kid",config.StringOf("boxAppSettings.appAuth.publicKeyID"))
set jwt = Server.CreateObject("Chilkat.Jwt")
set prng = Server.CreateObject("Chilkat.Prng")
nonce = prng.GenRandom(32,"hex")
If (prng.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( prng.LastErrorText) & "</pre>"
    Response.End
End If

set claims = Server.CreateObject("Chilkat.JsonObject")
success = claims.UpdateString("iss",config.StringOf("boxAppSettings.clientID"))
success = claims.UpdateString("sub",config.StringOf("enterpriseID"))
success = claims.UpdateString("box_sub_type","enterprise")
success = claims.UpdateString("aud","https://api.box.com/oauth2/token")
success = claims.UpdateString("jti",nonce)
success = claims.UpdateInt("exp",jwt.GenNumericDate(45))
assertion = jwt.CreateJwtPk(header.Emit(),claims.Emit(),key)
If (jwt.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( jwt.LastErrorText) & "</pre>"
    Response.End
End If

set curl = Server.CreateObject("Chilkat.HttpCurl")
curl.SetVar "client_id",config.StringOf("boxAppSettings.clientID")
curl.SetVar "client_secret",config.StringOf("boxAppSettings.clientSecret")
curl.SetVar "assertion",assertion
curl.ClearTargetOutput "*"
curl.ClearVar "access_token"
curl.AddTargetOutput "access_token","access_token"
success = curl.DoYourThing("curl -X POST ""https://api.box.com/oauth2/token"" --data-urlencode ""grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer"" --data-urlencode ""client_id={{client_id}}"" --data-urlencode ""client_secret={{client_secret}}"" --data-urlencode ""assertion={{assertion}}""")
If ((success <> 1) Or (curl.StatusCode <> 200)) Then
    Response.Write "<pre>" & Server.HTMLEncode( "Box request failed. HTTP status: " & curl.StatusCode) & "</pre>"
    Response.Write "<pre>" & Server.HTMLEncode( "Failure reason: " & curl.FailReason) & "</pre>"
    Response.End
End If

If (curl.VarDefined("!") <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( "Expected response fields are missing.") & "</pre>"
    Response.End
End If

'  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
'  a new assertion/token request, not by using a refresh token.
Response.Write "<pre>" & Server.HTMLEncode( "JWT access token obtained.") & "</pre>"

%>
</body>
</html>