C# Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

C#

bool success = false;

//  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

success = false;

Chilkat.JsonObject config = new Chilkat.JsonObject();
success = config.LoadFile("qa_data/tokens/box_jwt_config.json");
if (success != true) {
    Debug.WriteLine(config.LastErrorText);
    return;
}

Chilkat.PrivateKey key = new Chilkat.PrivateKey();
success = key.LoadEncryptedPem(config.StringOf("boxAppSettings.appAuth.privateKey"),config.StringOf("boxAppSettings.appAuth.passphrase"));
if (success != true) {
    Debug.WriteLine(key.LastErrorText);
    return;
}

Chilkat.JsonObject header = new Chilkat.JsonObject();
header.UpdateString("alg","RS256");
header.UpdateString("typ","JWT");
header.UpdateString("kid",config.StringOf("boxAppSettings.appAuth.publicKeyID"));
Chilkat.Jwt jwt = new Chilkat.Jwt();
Chilkat.Prng prng = new Chilkat.Prng();
string nonce = prng.GenRandom(32,"hex");
if (prng.LastMethodSuccess != true) {
    Debug.WriteLine(prng.LastErrorText);
    return;
}

Chilkat.JsonObject claims = new Chilkat.JsonObject();
claims.UpdateString("iss",config.StringOf("boxAppSettings.clientID"));
claims.UpdateString("sub",config.StringOf("enterpriseID"));
claims.UpdateString("box_sub_type","enterprise");
claims.UpdateString("aud","https://api.box.com/oauth2/token");
claims.UpdateString("jti",nonce);
claims.UpdateInt("exp",jwt.GenNumericDate(45));
string assertion = jwt.CreateJwtPk(header.Emit(),claims.Emit(),key);
if (jwt.LastMethodSuccess != true) {
    Debug.WriteLine(jwt.LastErrorText);
    return;
}

Chilkat.HttpCurl curl = new Chilkat.HttpCurl();
curl.SetVar("client_id",config.StringOf("boxAppSettings.clientID"));
curl.SetVar("client_secret",config.StringOf("boxAppSettings.clientSecret"));
curl.SetVar("assertion",assertion);
curl.ClearTargetOutput("*");
curl.ClearVar("access_token");
curl.AddTargetOutput("access_token","access_token");
success = curl.DoYourThing("curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"");
if ((success != true) || (curl.StatusCode != 200)) {
    Debug.WriteLine("Box request failed. HTTP status: " + Convert.ToString(curl.StatusCode));
    Debug.WriteLine("Failure reason: " + Convert.ToString(curl.FailReason));
    return;
}

if (curl.VarDefined("!") != true) {
    Debug.WriteLine("Expected response fields are missing.");
    return;
}

//  Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
//  a new assertion/token request, not by using a refresh token.
Debug.WriteLine("JWT access token obtained.");