Box for Developers

I can’t change redirect urls, all action fail, can’t add, can’t remove, can’t edit ​​​Box Developers Consolewith browser request Box cfg RequestResponse Body 

Hello,We develop a kintone plugin that integrates with Box using the OAuth 2.0 authorization code flow(https://account.box.com/api/oauth2/authorize).Recently, without any change on our side, users started seeing the following error page from Boxright after being redirected to the authorize URL:  Application Error  It looks like there's a problem with this application. ...  Error: invalid_request■ What we foundOur `state` parameter was an encrypted, hex-encoded string of about 1,250–1,310 characters.We tested the authorize endpoint with the same client_id and redirect_uri, changing only thelength of `state` (hex characters, no special characters):  - state length <= 1,024 characters : the normal Box login page is shown  - state length >= 1,025 characters : "invalid_request"The result was the same in repeated tests (3 times each around the boundary).Our `state` has been longer than 1,024 characters since we introduced it in May 2026.We have confirmed that authorization with the sam

Hello,I have a few questions about using the Developer Console and Platform apps with an Individual (Free) plan. Can I create and manage Platform apps in the Developer Console with an Individual (Free) plan? Can Platform apps created with an Individual plan be used continuously in a production environment to make Box API calls? Are there any plans to restrict or discontinue access to the Developer Console for Individual plan users in the future? I would appreciate your clarification.Thank you for your help!

I have two questions about Box V2 Webhooks. 1. When is FILE.UPLOADED triggered?When a new version of an existing file is created, is FILE.UPLOADED triggered for all of the following methods? Uploading a new version through the Box web interface API (POST /files/{id}/content) Saving through Box Drive Saving through Box Tools (Box Edit) Editing through Box for Microsoft 365 Editing through Box for Google Workspace 2. How often does FILE.UPLOADED fire during autosave or collaborative editing?When using Box for Microsoft 365 or Box for Google Workspace, is FILE.UPLOADED triggered every time a new file_version.id is created?Is there a defined or typical interval between version updates?I'm considering using webhooks for file synchronization and would like to understand the event frequency to avoid unnecessary processing.Any clarification would be appreciated. Thank you!

I am using Claude to extract data from backups, this works with OneDrive, but after I migrated to BOX, claude tells me “Linux shell on your laptop, and that shell still can’t open the Box folder.” The files are locally stored. I do not have a problem when using this in OneDrive. The Box MCP connector is connected and working. Anyone have any ideas. 

Hello,I have a free Box Individual account. I would like to create a user-authenticated OAuth 2.0 application under a separate free Developer account, then authorize it to upload personal backups to my existing Individual account.This would be a private, non-commercial integration used only by me. It would upload encrypted backup files, download them for integrity verification, and delete older backups according to a retention policy. It would not use Box AI or Box Sign.Before creating the Developer account, I would appreciate clarification on the following:1. Is this ongoing, private use permitted without purchasing a paid plan?2. Does the free Developer account expire or lose functionality after 30 days? The Developer Sandbox Management FAQ describes it as an initial 30-day evaluation, while the Free Developer Plan documentation describes a free plan without clearly stating an expiration date.3. Can an OAuth application owned by the Developer account be authorized by my existing free

I have a free developer account which has an App created in it which I use to access files for some of my clients. I access the clients files by having them share access with the service account within the app, generate a token for the service account using the https://api.box.com/oauth2/token endpoint, and can then hit several endpoints to interact with their files/folders, such as https://api.box.com/2.0/folders/:folderId/items. This generally works well and have not ran into any issues. A new client has custom Terms of Service set up for their enterprise. They have shared access with my service account, however when I send this request (https://api.box.com/2.0/folders/:folderId/items) using their folder id, I get a 404 saying folder not found (request id 66e17dihmcfldadh, for an example of that request). Upon further investigation I found this endpoint: https://api.box.com/2.0/collaborations?status=pending&fields=status,acceptance_requirements_status which returns one pending co

Hello Box Community,I'm developing VidHub, a personal media app that allows users to connect their own Box accounts through OAuth, organize their private videos and music, and stream them directly to their devices.VidHub is a commercial third-party app, but it is not a public media distribution service. Users access only their own private files.I've successfully tested the integration with two separate free Box Individual accounts, and I'd like to clarify a few things before launching: Free Individual accounts: Does Box's Fair Use Policy allow free Box Individual users to connect to commercial third-party OAuth apps like VidHub? API limits: My Box Developer Console currently shows 106/10,000 API calls. Is this allocation shared across all users of my application, or does each connected Box account have its own allocation? Personal media streaming: Is it permitted to use Box's temporary download URLs to stream a user's own private media directly to their device, without routing the

Hi community,We are comparing the Box Events API endpoints for enterprise event logging and noticing a timing gap between admin_logs and admin_logs_streaming.The official documentation mentions: admin_logs: Returns historical events strictly in chronological order with higher latency. admin_logs_streaming: Delivers events for live polling with much lower latency, but potentially out of order and with duplicates. For those running this in production: What average latency or time delay are you seeing on admin_logs before an event appears compared to admin_logs_streaming? How are you handling the latency gap when syncing live audit data into your SIEM or monitoring pipeline? Thanks for sharing your insights!

We’re new to Box and we have a client who wants to share files with us using the platform. On our side we want to integrate Box with our internal platform so we can pull the files in.  We created a platform app in the developer console and shared the service account email with the client.  The client then shared the folder with the service account.On our side, we can connect successfully via API using the access credentials provided during the platform app setup, but we are unable to accept the collaboration invite from the client, which is preventing the app from being able to see the contents of the folder.The documentation here says that we can just invite the service account like we would a normal user:A Service Account has its own folder tree, which starts empty. To give it access to existing content:By email: Invite the Service Account using its assigned email address, just as you would invite any other collaborator.Can anyone help point us in the right direction on this?  Should

Hi ,I would like to retrieve the IDs of subfolders within a Box folder associated with a Salesforce record.I believe the box.Toolkit class's getFolderContents method might be useful for this purpose, but I'm not sure what information is returned in the FolderContents object.Could anyone clarify the following?What information does the FolderContents object contain? Is it possible to retrieve a folder ID by using the folder name as a key from the FolderContents object?Any advice or code examples would be greatly appreciated.Thank you in advance for your help!

So, I used to be able to update the OAuth 2.0 Redirect URIs for an app, but I haven’t had to touch mine in a while. And now, whenever I try to change anything and click the “Save” button, nothing actually gets saved and an error popover shows up, warning, “Some changes on the Configuration Page could not be saved.”What’s up with this? Is there now some different way we’re supposed to do it?

Hi Box Support Team,We are running into an issue while collecting data from one of our shared customers.For data collection, we use the below API As-User header to access the customer's Box data.GET https://api.box.com/2.0/folders/{folder_id}/itemsWe have a customer where the authorization was configured using a user with the Co-Admin role. However, when we use this authorized user to collect data from another user who has either the Co-Admin or Admin role, the API returns a 403 Forbidden response.We would like to understand whether this is a known limitation of Box's As-User functionality or permissions model.Specifically:Can a user with the Co-Admin role, who has authorized our application, use the As-User header to access data belonging to another Co-Admin or Admin user? If this is not supported, is there any recommended approach to collect this data without changing the authorizing user's role to Admin? Are there any additional permissions, scopes, or configuration settings that wo

I am a systems integrator building an OAuth 2.0 application used to migrate customer-owned content from Box to another DAM. The OAuth application is owned by my free Box Developer account, while each customer authorizes the application using their own Box user account. The migration contains approximately 200,000 files and will generate several hundred thousand API requests. Which account's Platform API allocation applies to these requests? Does the developer account that owns the OAuth application require a paid Platform/Business subscription for production use? The customer’s source account is Individual.

Hello,We are developing a commercial SaaS application that integrates with Box, and we would like to clarify the requirements for using the Box API in production.Our planned integration works as follows: We create and manage a single Box Platform application using our company's Box Developer account. Our customers connect their own Box accounts to our SaaS application using OAuth 2.0. Our application accesses folders and downloads files using the customer's authorized access token. The downloaded files are processed and indexed to provide AI-powered search and question-answering functionality. Our application periodically checks for file changes and synchronizes updated files. We would like to confirm the following:1. Commercial useIs it permitted to use the Box API in this way as part of a commercial SaaS product?2. Developer account and licensingCan we operate this integration in production using a free Box Developer account, or does our company need a paid Box subscription o

For a first Box MCP experiment, I would prefer to give an AI agent access to one test folder rather than all of my files. Can that boundary be enforced by the Box connection, or does it depend entirely on the permissions of the authorizing user?Evgenii Arsentev covers the basic connection steps in his first MCP server guide. It is a general introduction, so I am looking for the Box-specific permissions to check before connecting real documents.

Hi, I integrated one of our apps with Box, one of the integration is OAuth2 connection. Our app will redirect the user to https://account.box.com/api/oauth2/authorize to perform OAuth2.  The problem is sometime it redirects the user to https://account.box.com/login/mfa and display error “We could not load the verification page. Please try again.”, after the user have the stale box website open for awhile. I have uploaded the screenshot in https://app.box.com/s/vnbaev9m9kxqgzmowaq7agsuxovzjih9 (there are some problem with the image upload in this editor)Clearing the browser cache can temporary fix the problem but it is not the correct fix as it breaks the UX & most of our users are from a non-technical background.It would be great if someone can take a look at this issue as it can cause huge trouble for our non-technical user. Thank you and looking forward to hearing back. 

Could someone from Box route this to the Box MCP support team?I use a personal Individual Box account connected to ChatGPT. On October 17, 2026, authentication, reading files, creating folders, and uploading small text files worked. However, these operations failed:• get_upload_url: MCP error -32602: Tool get_upload_url not found• upload_file_version: MCP error -32602: Tool upload_file_version not foundThis prevents uploading documents and updating existing files through ChatGPT.Can these two functions be enabled for an Individual or Personal Pro account? If so, how can a personal account enable them without an Admin Console?If this is a known integration issue, is there a supported workaround? If a different subscription is required, please identify a single-user plan that explicitly supports both functions before I purchase an upgrade.

Box Developer ConsoleのOAuth 2.0ユーザーアプリで、リダイレクトURIの変更だけが保存できず困っています。■症状「構成ページへの変更の一部を保存できませんでした」と表示され、再読み込みすると元のURI（https://app.box.com）に戻ります。他の設定項目は保存できます。■確認したこと・既存アプリと、新規作成したOAuth 2.0ユーザーアプリの両方で再現・Boxからログアウトし、ログインし直しても再現・既存URIを残して・Cloudflare WorkersのHTTPS URL（コールバック用パスあり・なし）で失敗・確認用の https://example.com/oauth/callback でも失敗追加する場合も、置き換える場合も失敗■保存時の通信保存処理のHTTPステータスは200 OKですが、応答本文は以下です。{"error":{"code":"Unexpected error"}}送信内容に正しいリダイレクトURIが含まれることも確認しています。利用プランはBox Individual（無料）です。原因や対処方法、アカウント側で確認すべき設定をご教示いただけますでしょうか。

Have to set up the Open Authorization in salesforce to be able to continue using box.  I followed the directions they gave me, but I kept coming up with an error when i tested it.  Can somebody help me with this? Thanks

I am receiving multiple errors when attempting to authenticate to Box via API (oauth2) started at approximately 8 AM CT this morning. Is anyone else encountering issues with Box API with your custom APPs? We have two custom apps in our organization, and they are both encountering issues. 

I am trying to test the Box API endpoint /2.0/notes/convert in Postman, which is used to convert Markdown content into a native .boxnote file in a target Box folder.However, I am not receiving the expected output when making the API request. I would like assistance in understanding the correct request format, required parameters, headers, and any specific requirements for successfully creating a .boxnote file from Markdown content.API Endpoint:https://api.box.com/2.0/notes/convertEnvironment: PostmanExpected Result:The Markdown content should be converted into a native Box Note (.boxnote) and created in the specified target folder.Actual Result:The API request giving the below error (Screenshot attached)Please provide guidance on the correct API request and any required configuration or permissions needed for this operation.Are this APIs only available for higher tier subscriptions? If yes the description in the “Plan comparison” is misleading because it does not state which APIs are a

My BoxAccessList, using OAuth2, read only, is not working anymore (active since 2022). It seems somehow that access is blocked. Can someone find out what the root cause is and remove the block.

Hi,I’m trying to use BOX CLI version @box/cli/4.10.1 linux-x64 node-v24.21.0in headless mode.I can access box using box cli and validating through a local browserIf I try headless I get an error.These are the steps.box login --code? How would you like to authenticate?[1] Log-in as a Box user (OAuth)[2] Use a Box Platform App[q] Quit? Enter 1, 2, or q: 1I paste in the URL given into a broswer on another computer and click Grant Access. This redirects to a localhost IP which includes the code and state. Similar to this http://localhost:3000/callback?state=12345678901234567890123456789012&code=ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFI enter the state and the code into the box cli  and get Login failed: Failed to exchange auth code for tokens.Can anyone help?

Free Developer account. Two User OAuth 2.0 Platform Apps on the same enterprise; both ENABLED. Authorization column shows "---" for both.Symptom on App A:- Authorize URL loads; login + Grant Access UI work- After Grant Access → Application Error / invalid_client on the authorize page- Never redirects to registered loopback URI; local catcher never gets ?code=- Token exchange never runs (Client Secret unused)Control: same authorize flow fails for both the free Developer app-owner login and a separate personal Box login (file owner).App B (sibling User OAuth on same enterprise) previously completed Grant successfully. Console config is the same class: User OAuth 2.0, redirect saved, Read+Write, unpublished, as-user off, CORS empty. Only intentional difference is the redirect URI (different loopback port/path for two tools).Already ruled out on our side: redirect typo (Details match Console), AI/Sign scopes on/off, authorize host, minimal client_id+response_type URL, Collaborators/Publish