Skip to main content
Question

Best Practices for API usage - How to get a process on a server to use Box

  • May 22, 2025
  • 2 replies
  • 23 views

Forum|alt.badge.img

Hello, all, first-time poster here.
I am wanting to develop an application that sits on a server, and when certain events are triggered, the server will go retrieve a file from Box and do something with it.  It may also move and/or delete the file, depending on external circumstances.

Generally speaking, how is this done? I don't want to tie the authentication that my server uses to a person's Box credentials, because it's possible that one day, those credentials will suddenly not be good anymore if the person gets hit by a truck, wins the lottery, or gets offered their dream job at another company.

Is it possible to have credentials that are tied to a machine or app instead of a person? Oh, I need to add that my company uses SSO, so that's another consideration. I don't know how to begin.

2 replies

Forum|alt.badge.img

Hi  ,

 

It sounds like you'll probably want to use a JWT authorization type for your application (https://developer.box.com/guides/authentication/jwt/). This will create a service account for the application. This account will be tied to the application rather than a Box User.

 

 


Forum|alt.badge.img

Hi  your requirement fits exactly in the "Oauth with JWT authentication" approach as correctly pointed by  as well.