Skip to main content
Question

Error 403 in Shared Links in Box API using Primary Access Token on App Token Authorization

  • May 22, 2025
  • 2 replies
  • 12 views
C
Forum|alt.badge.img

Hi, in the API reference, I understand that:

The shared_link.download_url is only returned for paid accounts.

I would like to confirm that me having a free account is the reason for having Error 403 on PUT create shared link, and `shared_link: null` on GET file info?

 

My next question is that if I upgrade to a paid plan, will I be automatically able to get the shared_link via GET by default after POST file upload?  


I'm using App Token Authorization and the Primary Access Token. Does this token have the permission of shared links? Are they enabled by default on POST file upload? I can't seem to find the permissions for an admin and primary access token. Or do I get the permissions/collaborators wrong? Would really appreciate if someone pointed me in the right direction. Thanks! 🙂

    2 replies

    C
    Forum|alt.badge.img

    I got this wrong from the very beginning aha :'(
    I TOTALLY FAILED to read this:

     

     

    Endpoints supported via App Token Auth
App Token Auth currently only supports previewing content stored in Box. The only Content APIs accessible through App Token Auth are Upload File, Download File, Delete File and Get Embed Link.

To provide feedback, please contact us here. We would love to hear from you!

     

    Meaning App Token auth was never designed for creating shared links in the first place isn't it? :'(

    We are currently using box api to be the host of fileuploads on a

    and I'm not sure how to proceed. My actual question should probably be, is there a way to have API access to shared links without having a guest go through user Oauth2?
    C
    Forum|alt.badge.img

     For server-to-server use cases where you don't want a user to need to log in via OAuth2, JWT Authentication is a good fit.  You can read more about why you might want to choose JWT auth and how to get started using JWT auth in the Box Developer documentation.

    Terms & ConditionsAccessibility statement