Client Credentials Grant (CCG) is an authentication method for
using
Server Authentication. It verifies your application’s identity with a client
ID and a client secret, and returns an access token without anyone signing in.
CCG is preselected for new Server apps.
How it works
Your application posts its client ID and client secret to the
with a
grant_type of client_credentials, along with the subject it authenticates as.
Box returns an access token that is valid for 60 minutes. No refresh token is
issued, so request a new access token when the current one expires.
Every token request names one of three subjects.
Both settings live on the Configuration tab of your app in the Box
Developer Console, and changing them means you have to
the application.
Your client secret identifies your application to Box, so treat it like a
password. Keep it out of email, public forums, code repositories, distributed
native applications, and client-side code. See the
for how to store and rotate it.
Switching to JWT
If your integration requires keypair-based authentication and your enterprise
allows switching auth types, you can
from the Configuration tab at any time. If switching is disabled, the method
is set when the app is created and can’t be changed later.
Set up an app with Client Credentials Grant
