> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Methods

When you create a Platform App, you select an app type based on how your app
runs. Regardless of the method used, underlying principles still apply. If a
user does not have access to content on the front end of the main Box web app,
they will not be able to access the content using the API, unless they are
impersonating another user. Some API endpoints require admin level
privileges — like events.

| App type              | Auth methods available        |
| --------------------- | ----------------------------- |
| User Authentication   | OAuth 2.0                     |
| Server Authentication | Client Credentials Grant, JWT |

## OAuth 2.0

[OAuth 2.0][oauth] is a client-side authentication method, widely used for its
simplicity in authorizing users to Box API. It's an open standard that allows
users to grant applications access to their data in other applications. Similar
to how logging in to a website with Twitter, Facebook, or Google works, Box's
client-side authentication involves redirecting a user from an app to the Box
web app, where they log in and grant the app access to their data. For example,
we use this auth type for users logging into our community forum.

Select **User** when you create your app.

<Note>
  **When to use OAuth 2.0?**

  Client-side authentication is the ideal authentication method for apps that:

  * Work with users who have existing Box accounts.
  * Use Box for identity management, so users know they are using Box.
  * Store data within each user account vs within an application's Service Account.
</Note>

You can find a great Python OAuth 2.0 tutorial on [GitHub][python_oauth].

## Client Credentials Grant (CCG)

[Client Credentials Grant][ccg] verifies an application's identity using a
client ID and secret. This method is particularly useful for scenarios
requiring server-to-server interactions without user involvement. Depending on
the application's configuration, it can authenticate as either the
application's Service Account or as a Managed User. Upon approval by an
administrator, a CCG application will get assigned a service account to make
API calls as by default.

Select **Server** when you create your app. **Client Credentials Grant** is the
default method, so a new Server Authentication app uses it unless you choose
otherwise. Depending on your enterprise's **Switch server app auth type (CCG or
JWT)** setting, you can switch the method later or must pick it during app
creation. See
[Choosing and changing the authentication method](/guides/authentication/select#changing-between-client-credentials-and-jwt).

<Note>
  **When to use CCG?**

  Server-side authentication with CCG is the ideal authentication method for apps
  that:

  * Work with users without Box accounts
  * Use their own identity system
  * Do not want users to know they are using Box
  * Store data within the application's Service Account and not a user's account
  * Want to manage public and private key pairs
</Note>

You can find a great Python CCG tutorial on [Medium][python_ccg].

## JSON Web Token (JWT)

[JWT][jwt] is an open standard that enables robust server-to-server
authentication. This method does not involve end-user interaction. It allows an
app, if granted appropriate privileges, to act on behalf of any user in an
enterprise, thus facilitating powerful and seamless integrations. Upon approval
by an administrator, a JWT application will get assigned a service account to
make API calls as by default.

Select **Server** when you create your app, then set the method to **JWT**.
Depending on your enterprise's **Switch server app auth type (CCG or JWT)**
setting, you choose **JWT** during app creation or switch to it later from the
**Configuration** tab. When switching is enabled, you can
[change between Client Credentials and JWT](/guides/authentication/select#changing-between-client-credentials-and-jwt)
at any time.

<Note>
  **When to use JWT?**

  Server-side authentication with JWT is the ideal authentication method for apps
  that:

  * Work with users without Box accounts
  * Use their own identity system
  * Do not want users to know they are using Box
  * Store data within the application's Service Account and not a user's account
  * Do not want to manage public and private key pairs
</Note>

You can find a great Node JWT tutorial on [Medium][node_jwt].

### User permissions and scopes

It is important to understand that even if an application has the right scopes
to perform an action, the user associated with the Access Token making the call
needs to have permission to perform the action as well and vice versa.

For example, if your application is set up to read files, the
authenticated user does need to have permission to read the file you are
trying to access.

To learn more about how scopes, token permissions, and user permissions work
together, see our [security guide][security].

<Next>
  Next step
</Next>

[oauth]: /guides/authentication/oauth2

[jwt]: /guides/authentication/jwt

[ata]: /guides/authentication/app-token

[ccg]: /guides/authentication/client-credentials

[app_ep]: /guides/authentication/app-token/endpoints

[scopes]: /guides/api-calls/permissions-and-errors/scopes

[at]: /guides/authentication/tokens

[security]: /guides/security

[reference]: /reference

[python_oauth]: https://github.com/box-community/box-python-oauth-template

[python_ccg]: https://medium.com/box-developer-blog/box-python-next-gen-sdk-getting-started-with-ccg-81be0abc82d9

[node_jwt]: https://medium.com/box-developer-blog/authenticate-box-node-js-sdk-with-jwt-47fdd3aeec50

[skill_watson]: https://medium.com/box-developer-blog/box-skills-ibm-watson-speech-to-text-tutorial-b7e3b3c0a8c7