ApiAuthentication

Page history last edited by jeremy@... 1 wk ago

Box.net Authentication

 

Every session with a Box application begins with user authentication, and must be handled from your application if you are not creating an OpenBox action. For simplicity, we will use the Box.net REST API, although you can also use the SOAP or XML Post APIs in your applications if you prefer -- the fundamental concepts are the same.

 

Box.net API authentication provides a secure way for users to authenticate with Box.net from other sites or applications without having to share their Box.net user name or password with third parties. This provides a consistent, reliable and safe experience for your users.

 

If you believe that our standard authentication process will not be compatible with your application, please feel free to discuss this matter by contacting developers@box.net.

 

To authenticate users you should apply the following steps:

 

  1. Obtain a ticket by calling the get_ticket method in the API.  You will want to generate a unique ticket for each user of your application or service.
  2. Redirect the user to https://www.box.net/api/1.0/auth/<ticket>.  This will display a Box.net authentication page that highlights your service.
  3. The user then authenticates by entering their user name and password on the authentication page

 

After the user has authenticated, the next step depends on whether you're writing a web application or a client application.

 

Web Applications

 

If you're writing a web application, Box.net can redirect the user to a page that you specify (the "Redirect url" that you can define within your OpenBox service).

 

The authentication appends a ticket variable to the end of this URL, passing you a request that looks like this:

 

 

After the user has been redirected to your callback page, you should store the auth_token value securely, since every API call your application makes from this point forward will require the application key and the authentication token to be passed in along with the call.

 

 

Desktop Applications

 

For desktop applications, the user is shown a message instructing them to return to the application after they have authenticated your application to access Box. Your application can then call get_auth_token with the ticket parameter to retrieve the authorization token.  You may want to present a button or other prompt on your application for the user to notify you of a successful authentication, so that you know when to call the 'get_auth_token' method.

 

At this point, you wiil likely want to either show the user the files in their Box or enable them to upload a file to their Box.

 

Need additional assistance? Please feel free to Contact us

Printable version
 
Anonymous Create an account or Log in