Using OAuth2 with JWT without a Box SDK

Hi  — you may find the guide at https://developer.box.com/v2.0/docs/construct-jwt-claim-manually useful.  It walks through constructing a JWT manually and using it to authenticate with the Box API.

I had to do this as there's no PHP SDK.

I use a library to help:

use Emarref\Jwt\Claim;
use Emarref\Jwt\HeaderParameter;

And in my Box class constructor...

function __construct($boxJson)
	{
		$this->Curl = new Curl;
		$boxJson = utf8_encode($boxJson);
		$boxJson = json_decode($boxJson);
		$uniqueID = uniqid('???');
		$token = new Emarref\Jwt\Token();
		
		$token->addClaim(new Claim\Audience('https://api.box.com/oauth2/token'));
		$token->addClaim(new Claim\Expiration(new \DateTime('60 seconds')));
		//$token->addClaim(new Claim\IssuedAt(new \DateTime('now')));
		$token->addClaim(new Claim\Issuer($boxJson->boxAppSettings->clientID));
		$token->addClaim(new Claim\JwtId($uniqueID));
		//$token->addClaim(new Claim\NotBefore(new \DateTime('now')));
		$token->addClaim(new Claim\Subject($boxJson->enterpriseID));
		$token->addHeader(new HeaderParameter\KeyId($boxJson->boxAppSettings->appAuth->publicKeyID));
		$token->addHeader(new HeaderParameter\Type('JWT'));
		$token->addClaim(new Claim\PrivateClaim('box_sub_type', 'enterprise'));
		//encrypt the JWT
		$algorithm = new Emarref\Jwt\Algorithm\Rs256();
		$encryption = Emarref\Jwt\Encryption\Factory::create($algorithm);
		$privateKey = openssl_get_privatekey($boxJson->boxAppSettings->appAuth->privateKey, $boxJson->boxAppSettings->appAuth->passphrase);
		$encryption->setPrivateKey($privateKey);
		$jwt = new \Emarref\Jwt\Jwt();
		$serializedToken = $jwt->serialize($token, $encryption);
		//get the token
		$TOKEN_RECEIVED = false;
		$TOKEN_ATTEMPTS = 0;
		do {
			$this->Curl->post('https://api.box.com/oauth2/token', array(
				'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
				'client_id' => $boxJson->boxAppSettings->clientID,
				'client_secret' => $boxJson->boxAppSettings->clientSecret,
				'assertion' => $serializedToken
			));
			if (isset($this->Curl->response->access_token)) {
				$TOKEN_RECEIVED = true;
			} else {
				$TOKEN_ATTEMPTS++;
				sleep(5);
			}
		} while (!$TOKEN_RECEIVED and $TOKEN_ATTEMPTS < 6);
		if (!$TOKEN_RECEIVED) {
			ob_start();
			var_dump($this->Curl->response);
			$TokenErrorText = ob_get_clean();
			$TokenErrorFile = 'logs/BoxTokenError-' . date('d-m-Y His') . '.txt';
			file_put_contents($TokenErrorFile, $TokenErrorText);
			exit;
		}
		//set the authorization header
		$this->AccessToken = $this->Curl->response->access_token;
		$this->Curl->setHeader('Authorization', "Bearer $this->AccessToken");
		$this->Curl->setHeader('Content-Type', 'application/json');
		
	}