Box

Overview

Connect your users to Box for enterprise file storage, collaboration, and content management.

Property	Value
Provider ID	box
Category	Storage
PKCE	Not supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Box OAuth App

Go to the Box Developer Console

Navigate to app.box.com/developers/console and sign in.

Create a new app

Click New App. Enter an app name, select User as the app type (apps where users link their Box accounts), and click Create. Do not select Server: a Server app has no OAuth 2.0 redirect URI configuration and the app type cannot be changed afterwards.

Add the redirect URI

Open the Configuration tab and add the Redirect URI from the Developer Portal under OAuth 2.0 Redirect URIs (HTTPS required, except for localhost / loopback).

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Box provider

Go to OAuth Providers > Add Provider > Box.

Enter credentials

• Client ID: Paste your Box Client ID
• Client Secret: Paste your Box Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
root_readonly	Read all files and folders stored in Box (further restricted by the user’s own permissions)
root_readwrite	Read and write all files and folders stored in Box: upload files and versions, download content, create folders, manage collaborations, comments and tasks
manage_managed_users	Manage the enterprise’s managed users (primary login, password resets, roles) — the token must belong to an Admin or Co-Admin
manage_groups	Create, update and delete enterprise groups and manage group membership — the token must belong to an Admin or Co-Admin
manage_webhook	Create, view, edit and delete webhooks for the user (limit of 1000 webhooks per application, per user)
manage_enterprise_properties	View the enterprise event stream, view and edit enterprise attributes and reports, and edit or delete device pins — the token must belong to an Admin or Co-Admin
manage_data_retention	View and create Box Governance retention policies (requires Box Governance and the request-only enterprise_content scope)
sign_requests.readwrite	Get, create, cancel and resend Box Sign requests (requires read/write scopes and Box Sign enabled on the enterprise)
ai.readwrite	Send requests to the Box AI API
manage_triggers	Interact with Box Relay endpoints and start WORKFLOW_MANUAL_START flows (requires read/write scopes)

Notes

• Enable the scopes the application will request under Configuration → Application Scopes: Box treats the scopes Alter Vault requests as a restriction of the app’s enabled scopes, so a scope that is not enabled on the app cannot be granted.
• Not offered: manage_app_users (App Users exist only for server-side JWT apps), the request-only manage_legal_holds / enterprise_content scopes (provisioned by Box support per enterprise), and the downscoping-only item_* / base_* / annotation_* scopes.
• Access tokens expire after 60 minutes; refresh tokens are valid for 60 days and are single-use — Alter Vault stores the new refresh token returned by every refresh.
• Box redirect URIs are matched exactly: scheme, domain, path, and query parameters must align (localhost may use any port).
• The app type (User vs Server) is fixed at creation: a Server app cannot be converted to a User (OAuth 2.0) app, so a wrong choice means creating a new app.
• See the Box OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
post_comments	send	POST	/comments
post_invites	admin, send	POST	/invites
post_users_id_email_aliases	admin, send	POST	/users/{user_id}/email_aliases
put_comments_id	send	PUT	/comments/{comment_id}
put_users_id_folders_0	admin, payment	PUT	/users/{user_id}/folders/0
delete_ai_agents_id	delete	DELETE	/ai_agents/{agent_id}
delete_collaboration_whitelist_entries_id	delete	DELETE	/collaboration_whitelist_entries/{collaboration_whitelist_entry_id}
delete_collaboration_whitelist_exempt_targets_id	admin, delete	DELETE	/collaboration_whitelist_exempt_targets/{collaboration_whitelist_exempt_target_id}
delete_collaborations_id	delete	DELETE	/collaborations/{collaboration_id}
delete_comments_id	delete	DELETE	/comments/{comment_id}
delete_device_pinners_id	delete	DELETE	/device_pinners/{device_pinner_id}
delete_file_requests_id	delete	DELETE	/file_requests/{file_request_id}
delete_files_id	delete	DELETE	/files/{file_id}
delete_files_id_metadata_enterprise_securityClassification-6VMVochwUWo	delete	DELETE	/files/{file_id}/metadata/enterprise/securityClassification-6VMVochwUWo
delete_files_id_metadata_global_boxSkillsCards	delete	DELETE	/files/{file_id}/metadata/global/boxSkillsCards
delete_files_id_metadata_id_id	admin, delete	DELETE	/files/{file_id}/metadata/{scope}/{template_key}
delete_files_id_trash	delete	DELETE	/files/{file_id}/trash
delete_files_id_versions_id	delete	DELETE	/files/{file_id}/versions/{file_version_id}
delete_files_id_watermark	delete	DELETE	/files/{file_id}/watermark
delete_files_upload_sessions_id	delete	DELETE	/files/upload_sessions/{upload_session_id}
delete_folder_locks_id	delete	DELETE	/folder_locks/{folder_lock_id}
post_files_id_metadata_id_id	admin, write	POST	/files/{file_id}/metadata/{scope}/{template_key}
post_folders_id_metadata_id_id	admin, write	POST	/folders/{folder_id}/metadata/{scope}/{template_key}
post_metadata_taxonomies_id_id_levels	admin, write	POST	/metadata_taxonomies/{namespace}/{taxonomy_key}/levels
post_metadata_taxonomies_id_id_nodes	admin, write	POST	/metadata_taxonomies/{namespace}/{taxonomy_key}/nodes
put_files_id_metadata_id_id	admin, write	PUT	/files/{file_id}/metadata/{scope}/{template_key}
post_file_requests_id_copy	write	POST	/file_requests/{file_request_id}/copy
post_files_id	write	POST	/files/{file_id}
post_files_id_content	write	POST	/files/{file_id}/content
post_files_id_copy	write	POST	/files/{file_id}/copy
post_files_id_metadata_enterprise_securityClassification-6VMVochwUWo	write	POST	/files/{file_id}/metadata/enterprise/securityClassification-6VMVochwUWo
post_files_id_metadata_global_boxSkillsCards	write	POST	/files/{file_id}/metadata/global/boxSkillsCards
post_files_id_upload_sessions	write	POST	/files/{file_id}/upload_sessions
post_files_id_versions_current	write	POST	/files/{file_id}/versions/current
get_comments_id	read	GET	/comments/{comment_id}
get_file_requests_id	read	GET	/file_requests/{file_request_id}
get_file_version_legal_holds_id	read	GET	/file_version_legal_holds/{file_version_legal_hold_id}
get_file_version_retentions_id	read	GET	/file_version_retentions/{file_version_retention_id}
get_files_id	read	GET	/files/{file_id}
get_files_id_app_item_associations	read	GET	/files/{file_id}/app_item_associations