> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Box with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Box account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Box actions.

> [!WARNING]
>
> The authentication method is fixed once the app is created, so confirm **Client Credentials Grant** before you create it. In an enterprise, a Box admin must authorize the app before it can mint a token, and the app must be reauthorized whenever you change its access level or scopes.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Create the app

Box issues Client Credentials Grant tokens to a Server Authentication app. Create one in the Box Developer Console, then configure its access level and scopes.

**1. Create the app**

Sign in to the [Box Developer Console](https://app.box.com/developers/console), then select **New App**.

<ul>
  <li>**App Name**: `StackOne Integration`</li>
  <li>**App Type**: **Server**</li>
  <li>**Select Method**: **Client Credentials Grant**</li>
  <li>Select **Create**.</li>
</ul>

![The Create a New App dialog with the app name entered, Server selected as the app type, and Client Credentials Grant selected as the method.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-create-app.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=f9075a428ea11409e49e9407ae2387da)

**2. Copy the client credentials**

The new app opens on its **Configuration** tab. Find the **Access** section of the **App Details** panel.

<ul>
  <li>Select **Copy** beside **Client ID**, then copy the **Client ID** into StackOne Hub.</li>
  <li>Select **Fetch Secret** under **Client Secret**, then copy the **Client Secret** into StackOne Hub.</li>
  <li>Box reveals the client secret only after two-factor authentication is enabled on your Box account.</li>
</ul>

![The Access section of the App Details panel showing the Client ID with its Copy button and the Fetch Secret button under Client Secret.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-client-credentials.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=dd66c70d6185c9e931484c98b9433b4d)

**3. Set the app access level**

In the **App Access Level** section, choose how much of your enterprise the app can reach.

<ul>
  <li>**App Access Only** limits the app to its own Service Account and any app users it creates.</li>
  <li>**App + Enterprise Access** lets the app manage enterprise settings, content, and users across managed accounts.</li>
  <li>Select **App + Enterprise Access** to connect as a managed user or an admin, or to use the **Manage enterprise properties** scope.</li>
</ul>

![The App Access Level section showing the App Access Only and App + Enterprise Access options.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-app-access-level.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=b6179eba8bcbc8ad99e76b413e6064c6)

**4. Add the content scopes**

Enables actions: Assign Task, Copy File, Copy Folder, Create Collaboration, Create Comment, Create File Metadata Instance, Create Folder, Create Folder Metadata Instance, Create Metadata Template, Create Task, Create Upload Session, Delete Comment, Delete File, Delete File Metadata Instance, Delete File Version, Delete Folder, Delete Folder Metadata Instance, Delete Task, Delete Task Assignment, Get Collaboration, Get Comment, Get Current User, Get File Information, Get File Metadata Instance, Get File Thumbnail, Get File Version, Get Folder Information, Get Folder Metadata Instance, Get Metadata Template, Get Task, Get Task Assignment, Get Trashed File, Get Trashed Folder, Get Unified Credentials, Get Unified Organization, Get Unified Role, Get User, Get User Avatar, List File Collaborations, List File Comments, List File Metadata Instances, List File Tasks, List File Versions, List Folder Collaborations, List Folder Items, List Folder Metadata Instances, List Metadata Templates, List Pending Collaborations, List Task Assignments, List Trashed Items, List Unified Organizations, List Unified Resource Types, List Unified Resource Users, List Unified Roles, Permanently Delete File, Permanently Delete Folder, Promote File Version, Query By Metadata, Remove Collaboration, Restore File From Trash, Restore File Version, Restore Folder From Trash, Search, Unlock File, Update Collaboration, Update Comment, Update File, Update File Metadata Instance, Update Folder, Update Folder Metadata Instance, Update Task, Update Task Assignment, Upload File, Upload File Version

In the **Application Scopes** section, expand **Content Actions** and enable the file and folder permissions.

![The Content Actions scopes with Read all files and folders stored in Box and Write all files and folders stored in Box enabled.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-content-scopes.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=33aaa183b9f568eddf5685d9945a854f)

<ul>
  <li>
    root\_readonly
  </li>

  <li>
    root\_readwrite
  </li>
</ul>

**5. Add the administrative and developer scopes**

Enables actions: Add User To Group, Create Group, Create User, Delete Group, Delete User, Delete User Avatar, Get Group, Get Unified Group, Get Unified User, Get User And Enterprise Events, Get Webhook, List Enterprise Users, List Group Collaborations, List Group Memberships, List Groups, List Unified Groups, List Unified Users, List Webhooks, Remove User From Group, Update Group, Update Group Membership, Update User

Expand **Administrative Actions** and **Developer Actions**, then enable the user, group, enterprise, and webhook permissions.

<ul>
  <li>**Manage enterprise properties** stays unavailable until **App + Enterprise Access** is selected.</li>
</ul>

![The Administrative Actions and Developer Actions scopes with Manage users, Manage groups, Manage enterprise properties, and Manage webhooks enabled.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-admin-scopes.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=4a55b49c9c3e309da2399cb1cb3f2de3)

<ul>
  <li>
    manage\_managed\_users
  </li>

  <li>
    manage\_groups
  </li>

  <li>
    manage\_enterprise\_properties
  </li>

  <li>
    manage\_webhook
  </li>
</ul>

**6. Enable user access tokens**

In the **Additional Configuration** section, turn on **Generate user access tokens**. This lets the app mint a token for a named Box user instead of its own Service Account.

<ul>
  <li>Leave it off if the connection only ever acts as the Service Account.</li>
</ul>

![The Additional Configuration section with the Generate user access tokens toggle turned on.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-user-access-tokens.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=7dc7c286377a9e017116558bfdfd28aa)

**7. Save the configuration**

Select **Save** at the top right of the **Configuration** tab.

<ul>
  <li>In an enterprise, open the app's authorization settings and submit the app for admin approval, or authorize it directly if you are an admin or co-admin.</li>
</ul>

![The Save button at the top right of the app Configuration tab.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-save.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=40fcab833cec165d8c846564f724e70a)

## Choose the identity to connect as

Box mints every Client Credentials Grant token for exactly one subject, and **Subject Type** and **Subject ID** name it together. The subject decides whose content the connection reads and writes, so pick the one that matches the data you need.

**1. Connect as the app's Service Account**

Creating the app also creates its Service Account, an automation user that owns its own content.

<ul>
  <li>**Subject Type**: **Enterprise (the app's Service Account)**</li>
  <li>**Subject ID**: your enterprise ID</li>
  <li>Select your account icon at the top right of the Developer Console, then select **Copy Enterprise ID**.</li>
  <li>The Service Account starts with an empty folder tree, so add it as a collaborator on the folders this connection needs before it can see your existing content.</li>
</ul>

![The Developer Console account menu with Copy Enterprise ID highlighted.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-enterprise-id.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=27d0bbdfdc66a2012b72fa617623ed87)

**2. Connect as a Box user**

Pick a user subject to read and write one person's own content instead of the Service Account's.

<ul>
  <li>**Subject Type**: **User (one specific Box user)**</li>
  <li>**Subject ID**: that user's Box user ID</li>
  <li>Open the Box **Admin Console**, go to **Users & Groups**, then read the value in the **USER ID** column of the **Managed Users** tab.</li>
  <li>A user subject needs **Generate user access tokens** turned on.</li>
  <li>A managed user or an admin also needs **App + Enterprise Access**.</li>
</ul>

![The Managed Users tab of Users & Groups in the Box Admin Console, with the USER ID column highlighted.](https://mintcdn.com/stackone-60/Zkbc177zMr0qj_Ul/connectors/box/images/client_credentials-config-user-id.png?fit=max\&auto=format\&n=Zkbc177zMr0qj_Ul\&q=85\&s=1299543e24dc2ca2140a458ef1d987f5)

## Monitor folders for webhook events

Fill in **Webhook Folder IDs** only to receive Box webhook events on this connection. StackOne registers a webhook on each folder you list.

**1. Find the folder IDs**

Open each folder you want to monitor in [Box](https://app.box.com), then read the ID from the end of the address.

<ul>
  <li>Format: `https://app.box.com/folder/{folderId}`</li>
  <li>Example: `https://app.box.com/folder/391960849645` has the folder ID `391960849645`</li>
  <li>Separate several folder IDs with commas.</li>
</ul>

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/box/guides/webhook-setup.md)
>
> Configure receiving Events for Box into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.