Cannot find access and refresh tokens


I am attempting to integrate an application in box with IBM App connect designer.
In app connect, I need to provide the following authentication data:

  • Access token
  • Refresh token
  • Client ID
  • Client Secret

I have already found the client ID and client secret, however the only token I was able to find was called a developer token.

Can anyone help me understand how I could aqcuire the access and refresh tokens for my application?

kind regards

Hi there, welcome to the forum!

I’m not sure how your app connect works, but if it is asking for a refresh token that implies there should be somewhere an expiration parameter.

Refresh tokens are common in OAuth 2.0 protocol, and usually involve redirecting the user to an authentication page, let me know if that is the case, you may be able to completely configure the App connect to automate the OAuth 2.0 process.

Please note that in box only the OAuth protocol will give you a refresh token.

If in your connect designer the refresh token is not mandatory, then you should be able to just use the developer token directly in the access token.

You could also manually do the OAuth process and get both the access and refresh tokens. The easiest way to do this would be to follow our postman quick start guide, which will give you these tokens.

If you have access to other tools a script and help you here to, for example check out our Python OAuth Template, this will save the tokens on a local file.

If you’re not using OAuth you can request a token directly to the API, for example using curl for a Client Credentials Grant (CCG)

curl --location '' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=h5z...qi' \
--data-urlencode 'client_secret=Tq...A38' \
--data-urlencode 'box_subject_type=enterprise' \
--data-urlencode 'box_subject_id=877840855'

Will result in:

    "access_token": "iL...R6",
    "expires_in": 4276,
    "restricted_to": [],
    "token_type": "bearer"

You can also investigate if the app connector supports anything else than OAuth.

Let us know if this helps


PS: just noticed that there is a box connector for IBM App connect. This might be easier to use.


I am using the box connector, however in my version of app connect it was asking for those tokens rather than login (perhaps the documentation is outdated or there just are 2 separate versions).

Using the postman quickstart guide you linked, I was able to retrieve the tokens very easily and have made the connection with app connect.

This topic can be marked as solved.

Thank you and kind regards.