POST
/oauth2/tokenRequest access token
Request an Access Token using either a client-side obtained OAuth 2.0 authorization code or a server-side JWT assertion.
An Access Token is a string that enables Box to verify that a request belongs to an authorized session. In the normal order of operations you will begin by requesting authentication from the authorize endpoint and Box will send you an authorization code.
You will then send this code to this endpoint to exchange it for an Access Token. The returned Access Token can then be used to to make Box API calls.
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
grant_typestringrequired
The type of request being made, either using a client-side obtained
authorization code, a refresh token, a JWT assertion, client credentials
grant or another access token for the purpose of downscoping a token.
client_idstringoptional
The Client ID of the application requesting an access token.
Used in combination with `authorization_code`, `client_credentials`, or
`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.
client_secretstringoptional
The client secret of the application requesting an access token.
Used in combination with `authorization_code`, `client_credentials`, or
`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.
codestringoptional
The client-side authorization code passed to your application by
Box in the browser redirect after the user has successfully
granted your application permission to make API calls on their
behalf.
Used in combination with `authorization_code` as the `grant_type`.
refresh_tokenstringoptional
A refresh token used to get a new access token with.
Used in combination with `refresh_token` as the `grant_type`.
assertionstringoptional
A JWT assertion for which to request a new access token.
Used in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer`
as the `grant_type`.
subject_tokenstringoptional
The token to exchange for a downscoped token. This can be a regular
access token, a JWT assertion, or an app token.
Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange`
as the `grant_type`.
subject_token_typestringoptional
The type of `subject_token` passed in.
Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange`
as the `grant_type`.
actor_tokenstringoptional
The token used to create an annotator token.
This is a JWT assertion.
Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange`
as the `grant_type`.
actor_token_typestringoptional
The type of `actor_token` passed in.
Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange`
as the `grant_type`.
scopestringoptional
The space-delimited list of scopes that you want apply to the
new access token.
The `subject_token` will need to have all of these scopes or
the call will error with **401 Unauthorized**..
resourcestringoptional
Full URL for the file that the token should be generated for.
box_subject_typestringoptional
Used in combination with `client_credentials` as the `grant_type`.
box_subject_idstringoptional
Used in combination with `client_credentials` as the `grant_type`.
Value is determined by `box_subject_type`. If `user` use user ID and if
`enterprise` use enterprise ID.
box_shared_linkstringoptional
Full URL of the shared link on the file or folder
that the token should be generated for.
200Returns a new Access Token that can be used to make authenticated
API calls by passing along the token in a authorization header as
follows `Authorization: Bearer <Token>`.
access_tokenstringoptional
The requested access token.
expires_inintegeroptional
The time in seconds by which this token will expire.
token_typestringoptional
The type of access token returned.
restricted_toarray<ResourceScope>optional
The permissions that this access token permits,
providing a list of resources (files, folders, etc)
and the scopes permitted for each of those resources.
refresh_tokenstringoptional
The refresh token for this access token, which can be used
to request a new access token when the current one expires.
issued_token_typestringoptional
The type of downscoped access token returned. This is only
returned if an access token has been downscoped.
400An authentication error.
errorstringoptional
The type of the error returned.
error_descriptionstringoptional
The type of the error returned.
defaultAn authentication error.
errorstringoptional
The type of the error returned.
error_descriptionstringoptional
The type of the error returned.
Error handling
A 400 is returned: An authentication error. Any other status is an error: An authentication error.