verapli
Sign inJoin free
Menu

Guides · storage · Popular APIs

Box Platform app (Developer Console)

Create a User app (OAuth 2.0) or Server app (JWT or Client Credentials Grant) in the Box Developer Console; Server apps need Box Admin authorisation in enterprise accounts, and Box Integrations listings (OAuth 2.0 only) are reviewed by the Box Partner team.

Researched · not yet run liveLast researched 25 October 2026 · Box · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Apps are created under a Box developer or enterprise account; Server apps act as a service account authorised by the enterprise admin.

  • Box developer account or enterprise user developer
  • Box enterprise (admin) organisationoptionalAdmin or Co-Admin must authorise JWT/CCG apps.

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create a platform app

    In the Developer Console create a new app and choose User (OAuth 2.0) or Server (JWT or Client Credentials Grant) authentication.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://account.box.com/developers/console

  2. Configure scopes and credentials

    On the Configuration tab set redirect URIs (OAuth), application scopes and access level; copy the Client ID and Client Secret; for JWT generate a public/private keypair.

    • verapli co-pilot
    • Human step: You press submit
    • After: Create a platform app

    verapli captures BOX_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    Where: https://account.box.com/developers/console

  3. Get admin authorisation (Server apps)

    Submit for approval from the Configuration tab, or give the Client ID to a Box Admin who adds it in Admin Console > Platform > Platform Apps. Re-authorise after changing scopes or access level.

    • Guided by hand
    • Human step: You press submit
    • After: Configure scopes and credentials
    If something goes wrong (1)
    • Scope changes don't take effect: Submit the app for re-authorisation; admins choose Reauthorize in Platform Apps. [2]

  4. Publish to Box Integrations (optional, OAuth 2.0 apps)optional

    On the Publishing tab confirm the checklist, fill in categories, descriptions, screenshots and icon, preview, then submit for approval.

    • verapli co-pilot
    • Human step: The provider reviews it
    • After: Configure scopes and credentials
    The provider says
    The Box Partner team reviews "as soon as possible"; no SLA stated. [3]

    Where: https://account.box.com/developers/console

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Server (JWT/CCG) apps can't call the API in an enterprise until a Box Admin or Co-Admin authorises them. [2]

Worth knowingThe rules say

Box Integrations listings accept only OAuth 2.0 apps. [3]

What you end up with

Env varSecretFormatWhat it is
BOX_CLIENT_IDnot secretopaque id stringApp client ID
BOX_CLIENT_SECRETsecretopaque secret stringApp client secret
BOX_ENTERPRISE_IDnot secretnumeric stringEnterprise ID (for JWT/CCG server auth) [to verify]
BOX_JWT_CONFIGsecret./box_config.jsonPath to the JWT app config JSON (includes private key) for JWT apps [to verify]

For agents

The same entry as JSON: /api/v1/entries/box/app · requirements /api/v1/requirements/box/app · terms /api/v1/terms/box/app.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Box Platform app (Developer Console), and how long will it take?"
  → tools/call requirements { "provider_id": "box/app" }

Sources

  1. Authentication OAuth 2.0 for User apps; CCG and JWT for Server apps (JWT uses keypair, CCG client ID/secret); App Token for Box View / Limited Access; Server apps must be authorised before calling the API; Developer Console at account.box.com/developers/console; developer sign-up at account.box.com/signup/developer. · accessed 25 October 2026 · official
  2. Platform app approval JWT/CCG apps need Box Admin or Co-Admin approval in enterprises (free developer accounts auto-authorise); admin enters Client ID in Admin Console > Platform > Platform Apps; scope or access changes require re-authorisation. · accessed 25 October 2026 · official
  3. Integrations Listing needs a production-ready OAuth 2.0 app; Developer Console > Publishing tab > checklist, listing form, Preview, submit for approval; Box Partner team reviews as soon as possible. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Box is not affiliated with verapli.