Delphi DLL Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

Delphi DLL

var
success: Boolean;
curl: HCkHttpCurl;
authorizedCommand1: HCkStringBuilder;
headerReplacement1: Integer;

begin
success := False;

//  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

success := False;

curl := CkHttpCurl_Create();
CkHttpCurl_SetVar(curl,'client_id','BOX_CLIENT_ID');
CkHttpCurl_SetVar(curl,'client_secret','BOX_CLIENT_SECRET');
CkHttpCurl_SetVar(curl,'enterprise_id','BOX_ENTERPRISE_ID');
//  enterprise identifies the app's service account. This is not an admin-user token.
CkHttpCurl_ClearTargetOutput(curl,'*');
CkHttpCurl_ClearVar(curl,'access_token');
CkHttpCurl_AddTargetOutput(curl,'access_token','access_token');
success := CkHttpCurl_DoYourThing(curl,'curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=client_credentials" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "box_subject_type=enterprise" --data-urlencode "box_subject_id={{enterprise_id}}"');
if ((success <> True) or (CkHttpCurl_getStatusCode(curl) <> 200)) then
  begin
    Memo1.Lines.Add('Box request failed. HTTP status: ' + IntToStr(CkHttpCurl_getStatusCode(curl)));
    Memo1.Lines.Add('Failure reason: ' + IntToStr(CkHttpCurl_getFailReason(curl)));
    Exit;
  end;
if (CkHttpCurl_VarDefined(curl,'!') <> True) then
  begin
    Memo1.Lines.Add('Expected response fields are missing.');
    Exit;
  end;
//  Keep this token in protected application memory; reacquire it when it expires.
//  Do not print tokens or the complete token response.
Memo1.Lines.Add('Service-account access token obtained.');
CkHttpCurl_ClearTargetOutput(curl,'*');
authorizedCommand1 := CkStringBuilder_Create();
CkStringBuilder_SetString(authorizedCommand1,'curl -X GET "https://api.box.com/2.0/users/me?fields=id,name,login" -H "Authorization: Bearer {{access_token}}"');
headerReplacement1 := CkStringBuilder_Replace(authorizedCommand1,'{{access_token}}',CkHttpCurl__getVar(curl,'access_token'));
success := CkHttpCurl_DoYourThing(curl,CkStringBuilder__getAsString(authorizedCommand1));
if ((success <> True) or (CkHttpCurl_getStatusCode(curl) <> 200)) then
  begin
    Memo1.Lines.Add('Box request failed. HTTP status: ' + IntToStr(CkHttpCurl_getStatusCode(curl)));
    Memo1.Lines.Add('Failure reason: ' + IntToStr(CkHttpCurl_getFailReason(curl)));
    Memo1.Lines.Add(CkHttpCurl__responseBodyStr(curl));
    Exit;
  end;
Memo1.Lines.Add(CkHttpCurl__responseBodyStr(curl));

CkHttpCurl_Dispose(curl);
CkStringBuilder_Dispose(authorizedCommand1);