C Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

C

#include <C_CkHttpCurl.h>
#include <C_CkStringBuilder.h>

void ChilkatSample(void)
    {
    BOOL success;
    HCkHttpCurl curl;
    HCkStringBuilder authorizedCommand1;
    int headerReplacement1;

    success = FALSE;

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = FALSE;

    curl = CkHttpCurl_Create();
    CkHttpCurl_SetVar(curl,"client_id","BOX_CLIENT_ID");
    CkHttpCurl_SetVar(curl,"client_secret","BOX_CLIENT_SECRET");
    CkHttpCurl_SetVar(curl,"enterprise_id","BOX_ENTERPRISE_ID");
    //  enterprise identifies the app's service account. This is not an admin-user token.
    CkHttpCurl_ClearTargetOutput(curl,"*");
    CkHttpCurl_ClearVar(curl,"access_token");
    CkHttpCurl_AddTargetOutput(curl,"access_token","access_token");
    success = CkHttpCurl_DoYourThing(curl,"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=client_credentials\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"box_subject_type=enterprise\" --data-urlencode \"box_subject_id={{enterprise_id}}\"");
    if ((success != TRUE) || (CkHttpCurl_getStatusCode(curl) != 200)) {
        printf("Box request failed. HTTP status: %d\n",CkHttpCurl_getStatusCode(curl));
        printf("Failure reason: %d\n",CkHttpCurl_getFailReason(curl));
        CkHttpCurl_Dispose(curl);
        return;
    }

    if (CkHttpCurl_VarDefined(curl,"!") != TRUE) {
        printf("Expected response fields are missing.\n");
        CkHttpCurl_Dispose(curl);
        return;
    }

    //  Keep this token in protected application memory; reacquire it when it expires.
    //  Do not print tokens or the complete token response.
    printf("Service-account access token obtained.\n");
    CkHttpCurl_ClearTargetOutput(curl,"*");
    authorizedCommand1 = CkStringBuilder_Create();
    CkStringBuilder_SetString(authorizedCommand1,"curl -X GET \"https://api.box.com/2.0/users/me?fields=id,name,login\" -H \"Authorization: Bearer {{access_token}}\"");
    headerReplacement1 = CkStringBuilder_Replace(authorizedCommand1,"{{access_token}}",CkHttpCurl_getVar(curl,"access_token"));
    success = CkHttpCurl_DoYourThing(curl,CkStringBuilder_getAsString(authorizedCommand1));
    if ((success != TRUE) || (CkHttpCurl_getStatusCode(curl) != 200)) {
        printf("Box request failed. HTTP status: %d\n",CkHttpCurl_getStatusCode(curl));
        printf("Failure reason: %d\n",CkHttpCurl_getFailReason(curl));
        printf("%s\n",CkHttpCurl_responseBodyStr(curl));
        CkHttpCurl_Dispose(curl);
        CkStringBuilder_Dispose(authorizedCommand1);
        return;
    }

    printf("%s\n",CkHttpCurl_responseBodyStr(curl));


    CkHttpCurl_Dispose(curl);
    CkStringBuilder_Dispose(authorizedCommand1);

    }