HI,

Taking the risk and assuming you are talking about the OAuth 2.0 authorization_code you get after successfully granting access to the user box account, then yes.

It is the whole purpose of the OAuth 2.0 protocol, to have the user manually, and explicitly granting that permission, and not giving their credentials to an app.

Having said that, there are other methods that don’t require user interaction, such as Client Credential Grants (CCG) or Json Web Tokens (JWT).

So depending on your use case you would select one of the authentication methods, OAuth 2.0, CCG or JWT.

Cheers