box

# box

Use the official `box` CLI to interact with the Box API from OpenClaw.

This skill is designed for headless deployments (e.g. Railway, CI,
servers). It does not use OAuth login flows or short-lived developer
tokens.

Instead, it expects Bring Your Own Credentials using:

-   Client Credentials Grant (CCG) --- recommended
-   JWT Server Auth --- optional

------------------------------------------------------------------------

# 🔐 Authentication (Bring Your Own Credentials)

This skill does not manage authentication automatically.

You must provide credentials before using Box commands.

⚠️ Never commit credential files (CCG JSON or JWT JSON) to git.

Add the following to your `.gitignore`:

    box-ccg.json
    box-jwt.json
    .secrets/

------------------------------------------------------------------------

## 🔑 User-Provided JSON Configuration (Required)

Users must supply their own Box CCG configuration file.\
The skill does **not** generate credentials or manage secrets.

Your file should look like:

``` json
{
  "boxAppSettings": {
    "clientID": "client_id_here",
    "clientSecret": "client_secret_here"
  },
  "enterpriseID": "enterprise_id_here"
}
```

This file can be named `box-ccg.json` and placed in your deployment
environment before registering it with Box CLI.

------------------------------------------------------------------------

## Option A --- Provide a CCG Config File (Recommended)

Create a Box Custom App using:

Server Authentication (Client Credentials Grant)

You will need:

-   clientID
-   clientSecret
-   enterpriseID

Create your config file in a secure location outside the workspace, e.g.:

/data/.secrets/box-ccg.json

⚠️ Avoid storing credentials inside the workspace directory — it may be tracked by git or accessible to other tools.

With:

{ "boxAppSettings": { "clientID": "YOUR_CLIENT_ID", "clientSecret":
"YOUR_CLIENT_SECRET" }, "enterpriseID": "YOUR_ENTERPRISE_ID" }

Secure it:

chmod 600 /data/.secrets/box-ccg.json

Re...