Search code examples
box-apiboxapiv2

BOX API - Choosing Authentication

I'm writing a backend application which will connect to an enterprise's box and should be able to access (get info, download content, search, get events about) all content in the enterprise.

I tried reading the following over and over:

  1. https://docs.box.com/docs/configuring-box-platform
  2. https://docs.box.com/docs/app-auth
  3. https://docs.box.com/docs/app-users

If I understand correctly, I would like to use App Auth so that no real user's credentials in the organization will be used in my app.

Also I think that a user access token should be sufficient for my needs as long as it will have access to the entire enterprise's content.

So my questions are :

  1. In order to create an App User I seem to need to first get an Enterprise Access Token and then use it to create the App User using a POST request? Can't this be done via the GUI once per an enterprise?

  2. Am I right that a user access token is sufficient for my needs and it will give access to the whole organization's content?

Thanks

Solution

  • As you mentioned, App Users are designed to be used with App Auth (JWT Authentication). App Users are API-only users in Box. For example, if you are building an application and need a place to store and access files on behalf of your end users, you can use App Users for this.

    For your use case, it sounds like you need to access Enterprise content from Managed Users. To access this data, you will need to implement Box's OAuth process.