PHP Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Chilkat2 PHP

<?php

use Chilkat2\HttpCurl;
use Chilkat2\JsonObject;
use Chilkat2\Jwt;
use Chilkat2\PrivateKey;
use Chilkat2\Prng;

$success = false;

// Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
// See Global Unlock Sample.
// Guide: Box API Guide.

$success = false;

$config = new JsonObject();
try {
    $config->LoadFile('qa_data/tokens/box_jwt_config.json');

    $key = new PrivateKey();
    $key->LoadEncryptedPem($config->StringOf('boxAppSettings.appAuth.privateKey'), $config->StringOf('boxAppSettings.appAuth.passphrase'));

    $header = new JsonObject();
    $header->UpdateString('alg', 'RS256');
    $header->UpdateString('typ', 'JWT');
    $header->UpdateString('kid', $config->StringOf('boxAppSettings.appAuth.publicKeyID'));
    $jwt = new Jwt();
    $prng = new Prng();
    $nonce = $prng->GenRandom(32, 'hex');

    $claims = new JsonObject();
    $claims->UpdateString('iss', $config->StringOf('boxAppSettings.clientID'));
    $claims->UpdateString('sub', $config->StringOf('enterpriseID'));
    $claims->UpdateString('box_sub_type', 'enterprise');
    $claims->UpdateString('aud', 'https://api.box.com/oauth2/token');
    $claims->UpdateString('jti', $nonce);
    $claims->UpdateInt('exp', $jwt->GenNumericDate(45));
    $assertion = $jwt->CreateJwtPk($header->Emit(), $claims->Emit(), $key);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

$curl = new HttpCurl();
$curl->SetVar('client_id', $config->StringOf('boxAppSettings.clientID'));
$curl->SetVar('client_secret', $config->StringOf('boxAppSettings.clientSecret'));
$curl->SetVar('assertion', $assertion);
$curl->ClearTargetOutput('*');
$curl->ClearVar('access_token');
$curl->AddTargetOutput('access_token', 'access_token');
try {
    $curl->DoYourThing('curl -X POST "https://api.box.com/oauth2/token" --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" --data-urlencode "client_id={{client_id}}" --data-urlencode "client_secret={{client_secret}}" --data-urlencode "assertion={{assertion}}"');
    $success = true;
} catch (\Chilkat2\Exception $e) {
    $success = false;
}
if ((!$success) || ($curl->StatusCode != 200)) {
    echo 'Box request failed. HTTP status: ', $curl->StatusCode, "\n";
    echo 'Failure reason: ', $curl->FailReason, "\n";
    exit;
}

if (!$curl->VarDefined('!')) {
    echo "Expected response fields are missing.\n";
    exit;
}

// Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
// a new assertion/token request, not by using a refresh token.
echo "JWT access token obtained.\n";