Hello -

I am working on a custom application that requires the use of annotations on files. I am consistently running into issues with annotations. Our application utilizes JWT for authentication.

When attempting to downscope the access token with scopes needed for the UI elements + annotations, I consistently get “Insufficient permissions” for the downscoped token. Upon looking at the permissions for my file using the downscoped token, I notice that there are additional permissions that are not enabled despite following the scopes outlined in the documentation:

Downscoped access token (scopes: base_preview item_download item_upload annotation_edit annotation_view_all base_sidebar item_comment item_preview)

{


    "type": "file",


    "etag": "0",


    "permissions": {


        "can_download": true,


        "can_preview": true,


        "can_upload": true,


        "can_comment": true,


        "can_rename": false,


        "can_delete": false,


        "can_share": false,


        "can_set_share_access": false,


        "can_invite_collaborator": false,


        "can_annotate": true,


        "can_view_annotations_all": true,


        "can_view_annotations_self": true,


        "can_create_annotations": false,


        "can_view_annotations": false


    }


}

Using an access token that has never been downscoped will have those “can_create_annotations” and “can_view_annotations” permissions as true. The behavior with that token is that I can annotate just fine, but any downscoped token cannot perform annotations at all. I can’t figure out if that is causing the issue or I am missing something else. I’m using the box-annotations library alongside the content preview + sidebar via cdn.

So instead, I went to the “Annotator Token” workflow and it ends up never working. I always get the same error {"error":"invalid_grant","error_description":"There was an error in the "actor_token". Algorithm not allowed"} - using the exact same steps to generate the assertion as the main access token (which works!). It’s being generated with the RS256 algorithm but it still rejects it. I was wondering if there was an issue with the assertion generated, but as it’s working fine to get the initial access token, I am just a little baffled.

Any advice or guidance would be greatly appreciated. I am not sure if this is the correct area to place this in.