> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Downscope a Token

export const Link = ({href, children, className, ...props}) => {
  const localizedHref = localizeLink(href);
  return <a href={localizedHref} className={className} {...props}>
      {children}
    </a>;
};

export const MultiRelatedLinks = ({sections = []}) => {
  if (!sections || sections.length === 0) {
    return null;
  }
  return <div className="space-y-8">
      {sections.map((section, index) => <RelatedLinks key={index} title={section.title} items={section.items} />)}
    </div>;
};

export const RelatedLinks = ({title, items = []}) => {
  const getBadgeClass = badge => {
    if (!badge) return "badge-default";
    const badgeType = badge.toLowerCase().replace(/\s+/g, "-");
    return `badge-${badge === "ガイド" ? "guide" : badgeType}`;
  };
  if (!items || items.length === 0) {
    return null;
  }
  return <div className="my-8">
      {}
      <h3 className="text-sm font-bold uppercase tracking-wider mb-4">{title}</h3>

      {}
      <div className="flex flex-col gap-3">
        {items.map((item, index) => <a key={index} href={item.href} className="py-2 px-3 rounded related_link hover:bg-[#f2f2f2] dark:hover:bg-[#111827] flex items-center gap-3 group no-underline hover:no-underline border-b-0">
            {}
            <span className={`px-2 py-1 rounded-full text-xs font-semibold uppercase tracking-wide flex-shrink-0 ${getBadgeClass(item.badge)}`}>
              {item.badge}
            </span>

            {}
            <span className="text-base">{item.label}</span>
          </a>)}
      </div>
    </div>;
};

<RelatedLinks
  title="REQUIRED GUIDES"
  items={[
{ label: translate("Tokens"), href: "/guides/authentication/tokens/index", badge: "GUIDE" }
]}
/>

Downscoping is a way to exchange an existing Access Token for a new one that is
more restricted.

## Reasons to downscope

An application might need to share the Access Token with an
environment that it does not fully control. A common example of this would be
when using Box UI Elements in a web browser.

When an application needs to pass an Access Token to the browser there is a
potential security risk that needs to be resolved. In order to limit this risk the
Access Token can be exchanged for a new token with much stricter permissions.

## High-level overview

A downscoped token is a token that has fewer permissions (scopes) than the
original token, as well as the optional additional restriction to only allow
access to a specific file.

<Frame border>
  <img src="https://mintcdn.com/box/J_EwM_J-GUl8Mc67/guides/authentication/tokens/downscope.png?fit=max&auto=format&n=J_EwM_J-GUl8Mc67&q=85&s=7167ee4e8b8f8346a5e5f7d4d31982bf" alt="Downscoping overview" width="1898" height="1064" data-path="guides/authentication/tokens/downscope.png" />
</Frame>

The new token takes the permissions of the original token and restricts them
to the tokens passed in, as well as the resource provided.

## Downscoping in practice

To downscope a token, pass the `POST /oauth2/token` endpoint an existing Access
Token, a list of scopes, as well as an optional file URL to restrict the token to.

| Parameter            | Description                                                                                                                                                                                                                                                                                                                                  |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `subject_token`      | The original token to downscope. This can be a token that was acquired through OAuth 2.0 or JWT token exchange.                                                                                                                                                                                                                              |
| `scope`              | A space-delimited list of <Link href="/guides/api-calls/permissions-and-errors/scopes">scopes</Link> to limit the new token to. Any valid scope for the application can be used, though a special set of <Link href="/guides/api-calls/permissions-and-errors/scopes/#scopes-for-downscoping">scopes for Box UI elements</Link> is available |
| `resource`           | An optional full URL path to the file the token should be restricted to.                                                                                                                                                                                                                                                                     |
| `box_shared_link`    | An optional <Link href="/guides/shared-links">shared link</Link> URL for a file or folder on Box. Password protected links are not supported. This option cannot be used in addition to the `resource` option nor can it be a shared link created on a weblink.                                                                              |
| `subject_token_type` | Always set to `urn:ietf:params:oauth:token-type:access_token`                                                                                                                                                                                                                                                                                |
| `grant_type`         | Always set to `urn:ietf:params:oauth:grant-type:token-exchange`                                                                                                                                                                                                                                                                              |

## Downscoped Access Token Object

A downscoped Access Token returned by the `POST /oauth2/token` endpoint contains
extra information on the specific restrictions.

```json theme={null}
{
  "access_token": "1!DgsZ6V9kMWZu2StrxwQDF5BudQNen-xUmU2cfcVKArE....",
  "expires_in": 4175,
  "token_type": "bearer",
  "restricted_to": [
    {
      "scope": "item_preview",
      "object": {
        "type": "folder",
        "id": "1234567890",
        "sequence_id": "0",
        "etag": "0",
        "name": "Test"
      }
    }
  ],
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token"
}
```

Most importantly here is the list of `restricted_to` entries that will contain
each combination of `object` and `scope` that the new token has the permissions for.

<Warning>
  A downscoped token does not include a refresh token. To get a new downscoped
  token, refresh the original refresh token and use that new token to get a
  downscoped token.
</Warning>

<RelatedLinks
  title="RELATED APIS"
  items={[
{ label: translate("Request access token"), href: "/reference/post-oauth2-token", badge: "POST" }
]}
/>

<RelatedLinks
  title="RELATED GUIDES"
  items={[
{ label: translate("Scopes"), href: "/guides/api-calls/permissions-and-errors/scopes", badge: "GUIDE" }
]}
/>