The authorization code grant is a commonly used authentication flow for web and native applications. It provides secure connections by requiring multiple points of authentication before permitting access to data. When using the authorization code flow, the application first navigates to the location hosting the temporary authorization code and retrieves it. Next, the authorization code is exchanged for an access token from the location specified in the Token URI option. If authentication takes place with a third-party authentication service, the application is redirected to the endpoint provided in the Redirect URI option to begin the session.
To use an authorization code grant:
The application should be configured to set the Auth Code (OauthCode) option to specify the authorization code that is exchanged for the access token.
Configure the minimum options required for a connection:
If you are using an input REST file, set the REST Config File (RestConfigFile) option to provide the name and location of the input REST file. For example, C:/path/to/box.rest.
If you are using the REST Sample Path method, set the REST Sample Path (RestSamplePath) option to specify the endpoint that the want to connect to and sample. For example, https://example.com/countries/.
Set the Authentication Method (AuthenticationMethod) option to OAuth2.
Set the Client ID (ClientID) option to specify the client ID key for your application.
Set the Token URI (TokenURI) option to specify the endpoint used to exchange authentication credentials for access tokens. For example, https://example.com/oauth2/authorize/.
If required by your authentication flow, set the Redirect URI (RedirectURI) option to specify the endpoint that the client is returned to after authenticating with a third-party service.
Optionally, set the Scope (Scope) option to specify a space-separated list of OAuth scopes to limit the permissions granted by the access token.
Optionally, specify values for any additional options you want to configure. See "Connection Option Descriptions" for a complete list of options.
The following example demonstrates a basic session for a Box account using an authorization code grant:
The application should be configured to set the Auth Code (OauthCode) option to specify the authorization code that is exchanged for the access token.