A Server app authenticates with either (CCG) or . Whether you can change that choice after the app exists depends on an enterprise setting, and the switch has consequences for credentials that are already in use.
Whether your enterprise allows switching
The Switch server app auth type (CCG or JWT) enterprise setting controls whether developers can change a Server app’s method after the app has been created. A Box Admin manages it in Admin Console > Enterprise Settings > Platform Apps, where it reads Allow developers to switch server app auth type for existing apps. It is enabled by default for free developer accounts and disabled by default for enterprises.
Where the setting is disabled, the method is fixed for the life of the app, so changing it means creating a new app.
Change the method
When switching is enabled, you change the method in the > Configuration tab > Server Authentication Method. You must complete multi-factor authentication (MFA) before saving the change. Re-authorization by a Box Admin is not required afterward.
Changing the authentication type revokes all credentials that are specific to the previous type. That includes JWT keypairs, passphrases, and any uploaded public keys. Your developer token is not revoked.Changing auth type causes downtime for any production traffic, and rotating secrets afterward is your responsibility. Only do this during a maintenance window or before your app begins handling production traffic.
Compare CCG and JWT before you switch
Set up an app with Client Credentials Grant
