Either I'm dense, or the docs assume I already know what they're telling me, but I need some clarification on doing authentication for a box.com app. I really don't understand whate's going on. As I read it:
- the app running on the user's machine sends a request to Box, including all the little secrets (Which aren't all that secret any more if the user knows how to read the code).
- The user is directed to the Box login page, which then sends the user to my server (with no page specified) attaching an authentication code.
- The app somehow magically gets that code back from my server and sends a request to Box for the access token.
- Box sends the access token to my server?
- The app again magically gets the access token from my server and sends its APT requests.
Obviously I got lost somewhere.
And, why do I have to have a server involved in the process? The article on making a JavaScript app refers to a direct request for a token. Is there documentation on that somewhere?
Answer
- You register your application on Box
- After registration you receive clientId and clientSecret once on Box website
- You hardcode your credentials somewhere in your application
- First time your application needs to access Box API it should redirect user to
https://www.box.com/api/oauth2/authorize, specifying your clientId, clientSecret and redirectURI as parameters. About redirectURI see below. - The box.com website opens. User enters his own credentials in the web form on box.com
- User allows your application to access his files via API on the box.com website
- Box redirects user back to you application using redirectURI specified before. One of the parameters to this request is "code". This is a very short-lived (30 seconds) access code that is only aligable for obtaining real access token.
- During next 30 seconds your application should make another call to Box API to next URL:
https://www.box.com/api/oauth2/token, specifying the previously obtained code. If everything was correct, your application receives an access_token, a refresh_token and "expires" values. - Now your application can make requests to Box API, specifying access_token every time
- access_token expires in number of seconds, specified in "expires" field. It should be about 3600 seconds or 1 hour. Each time your application sees that access_token has expired, it should make another request to Box with the refresh_token and obtain a fresh access_token for another 1 hour.
- refresh_token itself expires in 14 days
Note: if you develop a desktop application, then you should open browser for user on the step 4, redirectURI should be something like http://127.0.0.1:8080/Callback and you should run a small webserver just to catch the redirect with the code as in step 7.