Authentication method for Corporate Account needed {URGENT}

Hello, I would like to get some assistance here.

Currently I'm working on a feature to automate a functionality to upload automatically some files for a product. The files should be upload to a specific folders inside corporate account.

Problem is, those folders belong to a user who restricted the access, I need a way to access those folders, could be JWT authentication, I already created the code and is not working(Error 404, folder can't be found). However If I use developer token it works perfectly. OAuth 2 is not an option because we don't want user involvement and certainly we don't want to expose user token in the code.

If I understand correctly, I only have three options:

Create an application on admin level
The Owner of those folders can create the application but they don't have the experience
Use developer token to upload the files

I already saw the guides in box and I know where they are. I'm looking more for a professional advice and I need to solve this for yesterday(Work related).

Have someone faced this problem? Any suggestions? Either using or not the boxsdk or different method? FTP or something.

Thanks in advance

Kourtney

December 18, 2019 08:38

Hello ,

Your developer token is going to be associated with whoever is logged into the developer console when the generate token button is clicked. If using this token works, that means that user either owns or is collaborating on the folder ID you're trying to access. When using the default JWT token, you're going to be working with your application's service account (AutomationUser). Therefore, you have two options:

1.) Add your app's service account on the folder you're trying to access

2.) Obtain a token directly for a user that already has access; this is done in the sub claim of the JWT assertion

I hope that helped clarify!

Best,

Box Technical Support Engineer

mv891433

January 21, 2020 01:30

Thanks for the information Kourtney

January 21, 2020 02:10

Hello Kourtney,

I have a question, with the second method JWT assertion, the app's service is still required?

Comments