Guides Authentication
Edit this page


Authentication with the Box API uses an Access Token to identify a user. The way in which an Access Token is acquired depends on the method used to authorize a user. The type of authorization available to an application depends on the use-case as well as the type of application that has been created in the developer console.

Box Application TypeAuthentication methods
Custom AppOAuth 2.0, JWT, or Client Credentials Grant
Limited Access AppApp token
Custom SkillNo authentication method selection needed

Learn how to select an authorization type

Access Tokens for Authentication

Every API endpoint requires a valid and active Access Token to make API calls. An Access Token is a unique string that identifies an authenticated Box user to the API endpoints.

curl \
    -H "authorization: Bearer EGmDmRVfhfHsqesn5yVYHAqUkD0dyDfk"

Learn more about Access Tokens