Very recently the REST API for OIDC authentication (at the very least) changed such that HTTP headers are being returned with the wrong capitalization, e.g. "date" instead of "Date". The HTTP spec states that headers are case sensitive. We have worked around this, but I think Box should fix this.