PureBasic Requires Chilkat v11.5.0+

Box: Get a Service Account Token with Client Credentials

See more Box Examples

Obtain a Box service-account token using the client credentials grant. Configure and authorize a Server app first. Load credentials from protected application configuration; do not ship a client secret in a public client.

See the Box API guide for setup and the complete workflow.

PureBasic

IncludeFile "CkHttpCurl.pb"
IncludeFile "CkStringBuilder.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    ;  See Global Unlock Sample.
    ;  Guide: Box API Guide.

    success = 0

    curl.i = CkHttpCurl::ckCreate()
    If curl.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkHttpCurl::ckSetVar(curl,"client_id","BOX_CLIENT_ID")
    CkHttpCurl::ckSetVar(curl,"client_secret","BOX_CLIENT_SECRET")
    CkHttpCurl::ckSetVar(curl,"enterprise_id","BOX_ENTERPRISE_ID")
    ;  enterprise identifies the app's service account. This is not an admin-user token.
    CkHttpCurl::ckClearTargetOutput(curl,"*")
    CkHttpCurl::ckClearVar(curl,"access_token")
    CkHttpCurl::ckAddTargetOutput(curl,"access_token","access_token")
    success = CkHttpCurl::ckDoYourThing(curl,"curl -X POST " + Chr(34) + "https://api.box.com/oauth2/token" + Chr(34) + " --data-urlencode " + Chr(34) + "grant_type=client_credentials" + Chr(34) + " --data-urlencode " + Chr(34) + "client_id={{client_id}}" + Chr(34) + " --data-urlencode " + Chr(34) + "client_secret={{client_secret}}" + Chr(34) + " --data-urlencode " + Chr(34) + "box_subject_type=enterprise" + Chr(34) + " --data-urlencode " + Chr(34) + "box_subject_id={{enterprise_id}}" + Chr(34))
    If (success <> 1) OR (CkHttpCurl::ckStatusCode(curl) <> 200)
        Debug "Box request failed. HTTP status: " + Str(CkHttpCurl::ckStatusCode(curl))
        Debug "Failure reason: " + Str(CkHttpCurl::ckFailReason(curl))
        CkHttpCurl::ckDispose(curl)
        ProcedureReturn
    EndIf

    If CkHttpCurl::ckVarDefined(curl,"!") <> 1
        Debug "Expected response fields are missing."
        CkHttpCurl::ckDispose(curl)
        ProcedureReturn
    EndIf

    ;  Keep this token in protected application memory; reacquire it when it expires.
    ;  Do not print tokens or the complete token response.
    Debug "Service-account access token obtained."
    CkHttpCurl::ckClearTargetOutput(curl,"*")
    authorizedCommand1.i = CkStringBuilder::ckCreate()
    If authorizedCommand1.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkStringBuilder::ckSetString(authorizedCommand1,"curl -X GET " + Chr(34) + "https://api.box.com/2.0/users/me?fields=id,name,login" + Chr(34) + " -H " + Chr(34) + "Authorization: Bearer {{access_token}}" + Chr(34))
    headerReplacement1.i = CkStringBuilder::ckReplace(authorizedCommand1,"{{access_token}}",CkHttpCurl::ckGetVar(curl,"access_token"))
    success = CkHttpCurl::ckDoYourThing(curl,CkStringBuilder::ckGetAsString(authorizedCommand1))
    If (success <> 1) OR (CkHttpCurl::ckStatusCode(curl) <> 200)
        Debug "Box request failed. HTTP status: " + Str(CkHttpCurl::ckStatusCode(curl))
        Debug "Failure reason: " + Str(CkHttpCurl::ckFailReason(curl))
        Debug CkHttpCurl::ckResponseBodyStr(curl)
        CkHttpCurl::ckDispose(curl)
        CkStringBuilder::ckDispose(authorizedCommand1)
        ProcedureReturn
    EndIf

    Debug CkHttpCurl::ckResponseBodyStr(curl)


    CkHttpCurl::ckDispose(curl)
    CkStringBuilder::ckDispose(authorizedCommand1)


    ProcedureReturn
EndProcedure