C Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

C

#include <C_CkJsonObject.h>
#include <C_CkPrivateKey.h>
#include <C_CkJwt.h>
#include <C_CkPrng.h>
#include <C_CkHttpCurl.h>

void ChilkatSample(void)
    {
    BOOL success;
    HCkJsonObject config;
    HCkPrivateKey key;
    HCkJsonObject header;
    HCkJwt jwt;
    HCkPrng prng;
    const char *nonce;
    HCkJsonObject claims;
    const char *assertion;
    HCkHttpCurl curl;

    success = FALSE;

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = FALSE;

    config = CkJsonObject_Create();
    success = CkJsonObject_LoadFile(config,"qa_data/tokens/box_jwt_config.json");
    if (success != TRUE) {
        printf("%s\n",CkJsonObject_lastErrorText(config));
        CkJsonObject_Dispose(config);
        return;
    }

    key = CkPrivateKey_Create();
    success = CkPrivateKey_LoadEncryptedPem(key,CkJsonObject_stringOf(config,"boxAppSettings.appAuth.privateKey"),CkJsonObject_stringOf(config,"boxAppSettings.appAuth.passphrase"));
    if (success != TRUE) {
        printf("%s\n",CkPrivateKey_lastErrorText(key));
        CkJsonObject_Dispose(config);
        CkPrivateKey_Dispose(key);
        return;
    }

    header = CkJsonObject_Create();
    CkJsonObject_UpdateString(header,"alg","RS256");
    CkJsonObject_UpdateString(header,"typ","JWT");
    CkJsonObject_UpdateString(header,"kid",CkJsonObject_stringOf(config,"boxAppSettings.appAuth.publicKeyID"));
    jwt = CkJwt_Create();
    prng = CkPrng_Create();
    nonce = CkPrng_genRandom(prng,32,"hex");
    if (CkPrng_getLastMethodSuccess(prng) != TRUE) {
        printf("%s\n",CkPrng_lastErrorText(prng));
        CkJsonObject_Dispose(config);
        CkPrivateKey_Dispose(key);
        CkJsonObject_Dispose(header);
        CkJwt_Dispose(jwt);
        CkPrng_Dispose(prng);
        return;
    }

    claims = CkJsonObject_Create();
    CkJsonObject_UpdateString(claims,"iss",CkJsonObject_stringOf(config,"boxAppSettings.clientID"));
    CkJsonObject_UpdateString(claims,"sub",CkJsonObject_stringOf(config,"enterpriseID"));
    CkJsonObject_UpdateString(claims,"box_sub_type","enterprise");
    CkJsonObject_UpdateString(claims,"aud","https://api.box.com/oauth2/token");
    CkJsonObject_UpdateString(claims,"jti",nonce);
    CkJsonObject_UpdateInt(claims,"exp",CkJwt_GenNumericDate(jwt,45));
    assertion = CkJwt_createJwtPk(jwt,CkJsonObject_emit(header),CkJsonObject_emit(claims),key);
    if (CkJwt_getLastMethodSuccess(jwt) != TRUE) {
        printf("%s\n",CkJwt_lastErrorText(jwt));
        CkJsonObject_Dispose(config);
        CkPrivateKey_Dispose(key);
        CkJsonObject_Dispose(header);
        CkJwt_Dispose(jwt);
        CkPrng_Dispose(prng);
        CkJsonObject_Dispose(claims);
        return;
    }

    curl = CkHttpCurl_Create();
    CkHttpCurl_SetVar(curl,"client_id",CkJsonObject_stringOf(config,"boxAppSettings.clientID"));
    CkHttpCurl_SetVar(curl,"client_secret",CkJsonObject_stringOf(config,"boxAppSettings.clientSecret"));
    CkHttpCurl_SetVar(curl,"assertion",assertion);
    CkHttpCurl_ClearTargetOutput(curl,"*");
    CkHttpCurl_ClearVar(curl,"access_token");
    CkHttpCurl_AddTargetOutput(curl,"access_token","access_token");
    success = CkHttpCurl_DoYourThing(curl,"curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"");
    if ((success != TRUE) || (CkHttpCurl_getStatusCode(curl) != 200)) {
        printf("Box request failed. HTTP status: %d\n",CkHttpCurl_getStatusCode(curl));
        printf("Failure reason: %d\n",CkHttpCurl_getFailReason(curl));
        CkJsonObject_Dispose(config);
        CkPrivateKey_Dispose(key);
        CkJsonObject_Dispose(header);
        CkJwt_Dispose(jwt);
        CkPrng_Dispose(prng);
        CkJsonObject_Dispose(claims);
        CkHttpCurl_Dispose(curl);
        return;
    }

    if (CkHttpCurl_VarDefined(curl,"!") != TRUE) {
        printf("Expected response fields are missing.\n");
        CkJsonObject_Dispose(config);
        CkPrivateKey_Dispose(key);
        CkJsonObject_Dispose(header);
        CkJwt_Dispose(jwt);
        CkPrng_Dispose(prng);
        CkJsonObject_Dispose(claims);
        CkHttpCurl_Dispose(curl);
        return;
    }

    //  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
    //  a new assertion/token request, not by using a refresh token.
    printf("JWT access token obtained.\n");


    CkJsonObject_Dispose(config);
    CkPrivateKey_Dispose(key);
    CkJsonObject_Dispose(header);
    CkJwt_Dispose(jwt);
    CkPrng_Dispose(prng);
    CkJsonObject_Dispose(claims);
    CkHttpCurl_Dispose(curl);

    }