Box Developer Documentation
Log in

Download in Browser

Guides Downloads Download in Browser
Edit this page

Download in Browser

Sometimes an application wants to embed a file into a page as a HTML element. An example would be when working with an audio player.

<audio controls>
  <source src="..." type="audio/mp3">
</audio>

In this case, using the regular download URL does not work because the dl.boxcloud.com domain does not support Cross Origin Resource Sharing.

Instead an application can use the following format.

https://api.box.com/2.0/files/[FILE_ID]/content?access_token=[ACCESS_TOKEN]

CORS

For this to work the application needs to have the domain of the web site hosting this file added to the list of allowed domains in the CORS settings.

Downscope Token

Using this method would expose the Access Token to the end user, allowing them to potentially use this token to do more than intended. For this reason we recommend downscoping this token accordingly.