JWT Auth

Server-side authentication using JSON Web Tokens (JWT) is the most common way to authenticate to the Box API. JWT is an open standard designed to allow powerful server-to-server authentication.

Server-side authentication using JWT is available to . This authentication method does not require end-user interaction and, if granted the proper privileges, can be used to act on behalf of any user in an enterprise.

To use JWT, create a Server Authentication app and set its method to JWT. Depending on your enterprise’s Switch server app auth type (CCG or JWT) setting, you select JWT when you create the app or switch to it later from the Configuration tab. When switching is enabled, you can at any time.

Upon authorizing a JWT application, a is automatically generated and is the default Access Token used when authenticating. Because the Service Account has admin-like privileges, JWT applications must be before use.

When to use JWT

Server-side authentication with JWT is the ideal authentication method for apps that:

• Work with users that don’t have a Box account
• Want to use their own identity system
• Don’t want users to have to know that they are using Box
• Want to store data within the application’s Box account and not within the user’s Box account