> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokens

export const Link = ({href, children, className, ...props}) => {
  const localizedHref = href;
  return <a href={localizedHref} className={className} {...props}>
      {children}
    </a>;
};

At the core of every Box API call is an Access Token.
Similar to using the Box Web App, you will only be able to successfully interact
with content the user associated with the Access Token either a collaborator on
or owns. This can be further restricted by <Link href="/guides/authentication/tokens/downscope">downscoping</Link> a token.

<Warning>
  Required access scopes, application access, enabled advanced settings, user
  permissions, and endpoint-specific restrictions all work together to determine
  which API calls will be successful. For example, even if a user has
  collaborator access to a folder, a call to get information about the folder
  will not be successful if the read scope is not granted to the application.
</Warning>

## Types of tokens

| Type                                                                               | Duration           |
| ---------------------------------------------------------------------------------- | ------------------ |
| <Link href="/guides/authentication/tokens/access-tokens">Access Token</Link>       | 60 minutes         |
| <Link href="/guides/authentication/tokens/refresh">Refresh Token</Link>            | 60 days or one use |
| <Link href="/guides/authentication/tokens/developer-tokens">Developer Token</Link> | 60 minutes         |

## Application Types & Access Tokens

The following shows how each application type is expected to create an Access
Token.

| Box Application Type                    | How to get Access Token                                                                       |
| --------------------------------------- | --------------------------------------------------------------------------------------------- |
| Platform App + OAuth 2.0                | <Link href="/guides/authentication/oauth2/without-sdk">Explicit user grant</Link>             |
| Platform App + JWT                      | <Link href="/guides/authentication/oauth2/without-sdk">Exchange a JWT assertion</Link>        |
| Platform App + Client Credentials Grant | <Link href="/guides/authentication/client-credentials">Use client ID and client secret</Link> |

[devcon]: https://app.box.com/developers/console