Skip to main content
The authentication method is fixed once the app is created, so confirm Client Credentials Grant before you create it. In an enterprise, a Box admin must authorize the app before it can mint a token, and the app must be reauthorized whenever you change its access level or scopes.

​
Create the app

Box issues Client Credentials Grant tokens to a Server Authentication app. Create one in the Box Developer Console, then configure its access level and scopes.

1

Create the app

Sign in to the Box Developer Console, then select New App.

  • App Name: StackOne Integration
  • App Type: Server
  • Select Method: Client Credentials Grant
  • Select Create.
The Create a New App dialog with the app name entered, Server selected as the app type, and Client Credentials Grant selected as the method.
2

Copy the client credentials

The new app opens on its Configuration tab. Find the Access section of the App Details panel.

  • Select Copy beside Client ID, then copy the Client ID into StackOne Hub.
  • Select Fetch Secret under Client Secret, then copy the Client Secret into StackOne Hub.
  • Box reveals the client secret only after two-factor authentication is enabled on your Box account.
The Access section of the App Details panel showing the Client ID with its Copy button and the Fetch Secret button under Client Secret.
3

Set the app access level

In the App Access Level section, choose how much of your enterprise the app can reach.

  • App Access Only limits the app to its own Service Account and any app users it creates.
  • App + Enterprise Access lets the app manage enterprise settings, content, and users across managed accounts.
  • Select App + Enterprise Access to connect as a managed user or an admin, or to use the Manage enterprise properties scope.
The App Access Level section showing the App Access Only and App + Enterprise Access options.
4

Add the content scopes

Enables actions: Assign Task, Copy File, Copy Folder, Create Collaboration, Create Comment, Create File Metadata Instance, Create Folder, Create Folder Metadata Instance, Create Metadata Template, Create Task, Create Upload Session, Delete Comment, Delete File, Delete File Metadata Instance, Delete File Version, Delete Folder, Delete Folder Metadata Instance, Delete Task, Delete Task Assignment, Get Collaboration, Get Comment, Get Current User, Get File Information, Get File Metadata Instance, Get File Thumbnail, Get File Version, Get Folder Information, Get Folder Metadata Instance, Get Metadata Template, Get Task, Get Task Assignment, Get Trashed File, Get Trashed Folder, Get Unified Credentials, Get Unified Organization, Get Unified Role, Get User, Get User Avatar, List File Collaborations, List File Comments, List File Metadata Instances, List File Tasks, List File Versions, List Folder Collaborations, List Folder Items, List Folder Metadata Instances, List Metadata Templates, List Pending Collaborations, List Task Assignments, List Trashed Items, List Unified Organizations, List Unified Resource Types, List Unified Resource Users, List Unified Roles, Permanently Delete File, Permanently Delete Folder, Promote File Version, Query By Metadata, Remove Collaboration, Restore File From Trash, Restore File Version, Restore Folder From Trash, Search, Unlock File, Update Collaboration, Update Comment, Update File, Update File Metadata Instance, Update Folder, Update Folder Metadata Instance, Update Task, Update Task Assignment, Upload File, Upload File Version

In the Application Scopes section, expand Content Actions and enable the file and folder permissions.

The Content Actions scopes with Read all files and folders stored in Box and Write all files and folders stored in Box enabled.
5

Add the administrative and developer scopes

Enables actions: Add User To Group, Create Group, Create User, Delete Group, Delete User, Delete User Avatar, Get Group, Get Unified Group, Get Unified User, Get User And Enterprise Events, Get Webhook, List Enterprise Users, List Group Collaborations, List Group Memberships, List Groups, List Unified Groups, List Unified Users, List Webhooks, Remove User From Group, Update Group, Update Group Membership, Update User

Expand Administrative Actions and Developer Actions, then enable the user, group, enterprise, and webhook permissions.

  • Manage enterprise properties stays unavailable until App + Enterprise Access is selected.
The Administrative Actions and Developer Actions scopes with Manage users, Manage groups, Manage enterprise properties, and Manage webhooks enabled.
6

Enable user access tokens

In the Additional Configuration section, turn on Generate user access tokens. This lets the app mint a token for a named Box user instead of its own Service Account.

  • Leave it off if the connection only ever acts as the Service Account.
The Additional Configuration section with the Generate user access tokens toggle turned on.
7

Save the configuration

Select Save at the top right of the Configuration tab.

  • In an enterprise, open the app’s authorization settings and submit the app for admin approval, or authorize it directly if you are an admin or co-admin.
The Save button at the top right of the app Configuration tab.

​
Choose the identity to connect as

Box mints every Client Credentials Grant token for exactly one subject, and Subject Type and Subject ID name it together. The subject decides whose content the connection reads and writes, so pick the one that matches the data you need.

1

Connect as the app's Service Account

Creating the app also creates its Service Account, an automation user that owns its own content.

  • Subject Type: Enterprise (the app’s Service Account)
  • Subject ID: your enterprise ID
  • Select your account icon at the top right of the Developer Console, then select Copy Enterprise ID.
  • The Service Account starts with an empty folder tree, so add it as a collaborator on the folders this connection needs before it can see your existing content.
The Developer Console account menu with Copy Enterprise ID highlighted.
2

Connect as a Box user

Pick a user subject to read and write one person’s own content instead of the Service Account’s.

  • Subject Type: User (one specific Box user)
  • Subject ID: that user’s Box user ID
  • Open the Box Admin Console, go to Users & Groups, then read the value in the USER ID column of the Managed Users tab.
  • A user subject needs Generate user access tokens turned on.
  • A managed user or an admin also needs App + Enterprise Access.
The Managed Users tab of Users & Groups in the Box Admin Console, with the USER ID column highlighted.

​
Monitor folders for webhook events

Fill in Webhook Folder IDs only to receive Box webhook events on this connection. StackOne registers a webhook on each folder you list.

1

Find the folder IDs

Open each folder you want to monitor in Box, then read the ID from the end of the address.

  • Format: https://app.box.com/folder/{folderId}
  • Example: https://app.box.com/folder/391960849645 has the folder ID 391960849645
  • Separate several folder IDs with commas.
1

Connect

  • Click Connect.
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup.
2

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.

​
Next Steps

Webhooks setup

Configure receiving Events for Box into StackOne.