Rust Requires Chilkat v11.5.0+

Box: Get a Service Account Token with JWT

See more Box Examples

Use the encrypted private key in a Box application configuration file to sign a short-lived assertion and exchange it for an access token. Configure and authorize a JWT Server app first. The enterprise subject obtains the service-account token.

See the Box API guide for setup and the complete workflow.

Rust

let mut success = false;

// Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
// See Global Unlock Sample.
// Guide: Box API Guide.

success = false;

let config = chilkat::JsonObject::new();
success = config.load_file("qa_data/tokens/box_jwt_config.json").is_ok();
if !success {
    println!("{}", config.last_error_text());
    return;
}

let key = chilkat::PrivateKey::new();
success = key.load_encrypted_pem(&config.string_of("boxAppSettings.appAuth.privateKey").unwrap_or_default(), &config.string_of("boxAppSettings.appAuth.passphrase").unwrap_or_default()).is_ok();
if !success {
    println!("{}", key.last_error_text());
    return;
}

let header = chilkat::JsonObject::new();
let _ = header.update_string("alg", "RS256");
let _ = header.update_string("typ", "JWT");
let _ = header.update_string("kid", &config.string_of("boxAppSettings.appAuth.publicKeyID").unwrap_or_default());
let jwt = chilkat::Jwt::new();
let prng = chilkat::Prng::new();
let Ok(nonce) = prng.gen_random(32, "hex") else {
    println!("{}", prng.last_error_text());
    return;
};

let claims = chilkat::JsonObject::new();
let _ = claims.update_string("iss", &config.string_of("boxAppSettings.clientID").unwrap_or_default());
let _ = claims.update_string("sub", &config.string_of("enterpriseID").unwrap_or_default());
let _ = claims.update_string("box_sub_type", "enterprise");
let _ = claims.update_string("aud", "https://api.box.com/oauth2/token");
let _ = claims.update_string("jti", &nonce);
let _ = claims.update_int("exp", jwt.gen_numeric_date(45));
let Ok(assertion) = jwt.create_jwt_pk(&header.emit().unwrap_or_default(), &claims.emit().unwrap_or_default(), &key) else {
    println!("{}", jwt.last_error_text());
    return;
};

let curl = chilkat::HttpCurl::new();
curl.set_var("client_id", &config.string_of("boxAppSettings.clientID").unwrap_or_default());
curl.set_var("client_secret", &config.string_of("boxAppSettings.clientSecret").unwrap_or_default());
curl.set_var("assertion", &assertion);
curl.clear_target_output("*");
curl.clear_var("access_token");
curl.add_target_output("access_token", "access_token");
success = curl.do_your_thing("curl -X POST \"https://api.box.com/oauth2/token\" --data-urlencode \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer\" --data-urlencode \"client_id={{client_id}}\" --data-urlencode \"client_secret={{client_secret}}\" --data-urlencode \"assertion={{assertion}}\"").is_ok();
if (!success) || (curl.status_code() != 200) {
    println!("Box request failed. HTTP status: {}", curl.status_code());
    println!("Failure reason: {}", curl.fail_reason());
    return;
}

if !curl.var_defined("!") {
    println!("Expected response fields are missing.");
    return;
}

// Reuse the token in this HttpCurl instance. JWT tokens are renewed by making
// a new assertion/token request, not by using a refresh token.
println!("JWT access token obtained.");