Skip to main content
When you create a new app in the Developer Console, Box asks you to select an app type based on how your app runs. Pick the one that matches your use case.

Learn how to create a Platform App

​
OAuth 2.0

Choose the User app type if your app runs in a browser or has a user-facing login flow. OAuth 2.0 redirects end users to Box to log in and authorize the application to act on their behalf.
Box OAuth 2.0 approval
When to use OAuth 2.0?OAuth 2.0 is the ideal authentication method for apps that:
  • work with users who have existing Box accounts
  • use Box for identity management, so users know they are using Box
  • store data within each user’s account rather than within an application’s Service Account

Learn about OAuth 2.0 authentication

​
Server authentication

Choose Server if your app is a backend service, automation, or any integration that runs without direct user interaction. Server authentication apps do not require end-user login and, if granted the proper privileges, can act on behalf of any user in an enterprise. A server authentication app uses one of two authentication methods:
  • : verifies identity using a client ID and client secret.
  • : verifies identity using a public/private keypair.
Whether you pick the method while creating the app or set it afterward from the Configuration tab depends on an enterprise setting. See Choosing and changing the authentication method.
When to use server authentication?Server authentication is the ideal path for apps that:
  • work with users who do not have Box accounts
  • use their own identity system
  • do not want users to know they are using Box
  • store data within the application’s Service Account rather than within a user’s account

Learn about Client Credentials Grant

Learn about JWT authentication

​
Changing between Client Credentials and JWT

The Switch server app auth type (CCG or JWT) enterprise setting controls whether developers can change a server authentication app’s method after the app has been created. A Box Admin manages it in Admin Console > Enterprise Settings > Platform Apps. It is enabled by default for free developer accounts and disabled by default for enterprises. Client Credentials Grant is always the default: if you click Create without changing anything, the new app uses CCG. The setting determines whether the method is locked and if the Create a New App dialog surfaces the choice up front. When the setting is enabled, the Create a New App dialog does not show a method picker. The app is simply created using Client Credentials Grant. You can then switch to JWT, or back to CCG, at any time from the Configuration tab in the Developer Console. When the setting is disabled, the Create a New App dialog shows a Select Method step with Client Credentials Grant preselected. Because the method is fixed for the life of the app, this is your chance to pick JWT instead. To change the method afterward, create a new app.
Changing the authentication type will revoke all credentials that are specific to the previous type. That includes JWT key pairs, passphrases, and any uploaded public keys. Your developer token will not be revoked.Changing auth type will cause downtime for any production traffic. It is your responsibility to rotate secrets afterward. Only do this during a maintenance window or before your app begins handling production traffic.
When switching is enabled, you must complete multi-factor authentication before saving the change. Re-authorization by a Box Admin is not required after the change. All other application configurations - scopes, webhooks, CORS domains, and advanced features - are preserved.

​
Comparison

The following is a quick overview of the key differences between authentication methods.
Apps created with a free developer account are authorized automatically. In that environment, JWT and Client Credentials Grant apps don’t require a separate admin approval step before use. provides more details details on authorization.
An Access Token is tied to a specific Box user. The way the token has been obtained determines who that user is.For example, when using OAuth 2.0 the token represents the user who granted access to their account, while when using server authentication the token defaults to the application’s Service Account.
Last modified on July 14, 2026