> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Switch between CCG and JWT

> Check whether your enterprise allows changing a Server app's authentication method, and see what a switch revokes and what it preserves.

export const Link = ({href, children, className, ...props}) => {
  const localizedHref = localizeLink(href);
  return <a href={localizedHref} className={className} {...props}>
      {children}
    </a>;
};

A Server app authenticates with either <Link href="/guides/authentication/client-credentials">Client Credentials Grant</Link> (CCG) or <Link href="/guides/authentication/jwt">JWT</Link>. Whether you can change that choice after the app exists depends on an enterprise setting, and the switch has consequences for credentials that are already in use.

## Whether your enterprise allows switching

The **Switch server app auth type (CCG or JWT)** enterprise setting controls whether developers can change a Server app's method after the app has been created. A Box Admin manages it in **Admin Console** > **Enterprise Settings** > **Platform Apps**, where it reads **Allow developers to switch server app auth type for existing apps**. It is enabled by default for free developer accounts and disabled by default for enterprises.

Where the setting is disabled, the method is fixed for the life of the app, so changing it means creating a new app.

## Change the method

When switching is enabled, you change the method in the <Link href="https://app.box.com/developers/console">Developer Console</Link> > **Configuration** tab > **Server Authentication Method**. You must complete [multi-factor authentication (MFA)](https://support.box.com/hc/en-us/articles/360043697154-Multi-Factor-Authentication-Set-Up-for-Your-Account) before saving the change. Re-authorization by a Box Admin is not required afterward.

<Warning>
  Changing the authentication type revokes all credentials that are specific to the previous type. That includes JWT keypairs, passphrases, and any uploaded public keys. Your developer token is not revoked.

  Changing auth type causes downtime for any production traffic, and rotating secrets afterward is your responsibility. Only do this during a maintenance window or before your app begins handling production traffic.
</Warning>

All other application configurations, including scopes, webhooks, CORS domains, and advanced features, are preserved.

<Card href={localizeLink("/guides/authentication#choosing-between-ccg-and-jwt")} arrow title="Compare CCG and JWT before you switch" />

<Card href={localizeLink("/guides/authentication/jwt/jwt-setup")} arrow title="Set up an app with JWT" />

<Card href={localizeLink("/guides/authentication/client-credentials/client-credentials-setup")} arrow title="Set up an app with Client Credentials Grant" />