Using an authentication token obtained from v1 API in a V2 API request

1
votes

As I couldn't find how to authenticate with the V2 API with my Box credential I tried to use the authentication token from a V1 API with a V2 request.

I discovered something weird and I'd like to know if something is wrong.

The documentation of the header to authenticate a V2 request described it like this for a curl command): curl -k -L https://api.box.com/2.0/files/5053864602/content -H "Authorization: Bearer AUTH_TOKEN"

With curl I couldn't get anything, not even an error message. However I tried this request with Postman and in the response I could see that the token was invalid.

In this forum I found that the header could have a different form including the api_key so I tried the following: curl -k -L https://api.box.com/2.0/files/5053864602/content -H "Authorization: BoxAuth api_key=API_KEY&auth_token=AUTH_TOKEN"

and this request works as I could get the content of the file like with a V1 API call.

Could someone from BOX explains what's going on? I suspect that I'm not the only one having this problem...

1
box-api
I can see API documentation is changed. 4-5 days back Authorization header contained both authToken and APIkey. May be a technical change from BOX. Have to wait for BOX developers for some reply. – user-457786

1 Answers

1
votes

The Box API now supports OAuth 2, which has a completely revised authentication flow. You can find the instructions on how to use OAuth 2.0 with Box here: http://developers.box.com/oauth/

V1-style auth is still also supported in the V2 API, though it will eventually be deprecated. However, if you're starting to build against the Box API now, you should use OAuth 2 in order to avoid having to do double work and port over in the future.

There are several differences between V1-style auth and OAuth 2.0, but notably in OAuth 2.0 you don't have to sign API requests with your API key (which is now called a 'client id' with OAuth 2.0), only the access_token you get through the auth process.

You can read more about our implementation of OAuth 2 in my previous link, and also about the spec in general here.