Skip to main content
Sometimes an application wants to embed a file into a page as a HTML element. An example would be when working with an audio player. 
<audio controls>
  <source src="..." type="audio/mp3">
</audio>
In this case, using the regular does not work because the dl.boxcloud.com domain does not support . Instead an application can use the following format. 
https://api.box.com/2.0/files/[FILE_ID]/content?access_token=[ACCESS_TOKEN]
CORSFor this to work the application needs to have the domain of the web site hosting this file added to the list of allowed domains in the .
Downscope TokenUsing this method would expose the Access Token to the end user, allowing them to potentially use this token to do more than intended. For this reason we recommend this token accordingly.