Hello there,

I was using WinSCP to download a folder's content from box. My DevOPS just suggested me to use the Box API Client to do so. I read the documentation and it sounded to be so straight forward. Well, here I am having troubles to get the first step of the process.

This is what I have done so far.

Created a Custom App - Server Authentication (Client Credentials Grant)

    - App Name: DCTBox CLI
    - User ID: <let me know if you need this value>
    - Enterprise ID: <let me know if you need this value>

Configured the Custom App as follow:

Authentication Method: 

OAuth 2.0 with Client Credentials Grant (Server Authentication)
OAuth 2.0 Credentials:
    - Client ID : 7cualakprhdcai7nrb3ekf9a9oe1qva6
    - Client Secret : <this is a non disclosure information>
App Access Level: App + Enterprise Access
Application Scopes:
    - Granted "Read all files and folders stored in Box"
    - Granted "Write all files and folders stored in Box"
    - Granted "Manage users"
Advanced Features:
    - Granted "Make API calls using the as-user header"
    - Granted "Generate user access tokens"

Submitted the Custom App for authorization for access to the Enterprise. Since the Custom App has been authorized, a Service Account was automatically generated. This account is a user representation of my app. By default my app makes API calls as this user. I added the Service Account as "Collaborator" to the Custom App using the Service Account ID.

After that I created a Power Shell script to use CURL.exe to get the authorization token and execute the API command to download the files as follow:

$rundate = Get-Date
Echo "-- Request an Access Token from box.com via URL on: $rundate --"

curl.exe -i -X POST "https://api.box.com/oauth2/token" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "box_subject_type=enterprise" -d "box_subject_id=265546" -d "client_id=7cualakprhdcai7nrb3ekf9a9oe1qva6" -d "client_secret=<Fetched Client Secret>"

As you can see I have also tried using the user as a box subject type instead of the enterprise. Same results.

#curl.exe -i -k -X POST "https://api.box.com/oauth2/token" -H "Content-type: application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "box_subject_type=user" -d "box_subject_id=304270971" -d "client_id=7cualakprhdcai7nrb3ekf9a9oe1qva6" -d "client_secret=<Fetched Client Secret>"

$rundate = Get-Date
Echo "-- Starting to get data from box.com via API on: $rundate --"
Try {
        box folders:download 150467792279 --destination=C:\ --depth=0
}
catch {
    Echo "Failed to download files. Exits script." -errorMessage "Invalid input data." -output true -color Red
    Exit 1
}

Unfortunately, the PS script is failing when trying to get the authorization token:

HTTP/2 400 
date: Tue, 21 Mar 2023 18:56:31 GMT
content-type: application/json
strict-transport-security: max-age=31536000
set-cookie: box_visitor_id=6419fddfa8a3b3.98060538; expires=Thu, 21-Mar-2024 18:56:31 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite
=None
set-cookie: bv=OPS-45999; expires=Tue, 28-Mar-2023 18:56:31 GMT; Max-Age=604800; path=/; domain=.app.box.com; secure
set-cookie: cn=65; expires=Thu, 21-Mar-2024 18:56:31 GMT; Max-Age=31622400; path=/; domain=.app.box.com; secure
set-cookie: site_preference=desktop; path=/; domain=.box.com; secure
cache-control: no-store
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; 
ma=2592000; v="46,43"

{"error":"invalid_client","error_description":"The client credentials are invalid"}
-- Finished getting data from Box.com at 03/21/2023 11:56:31 --

Any guidelines here would be really appreciated.