# Box Setup: Connect & Transfer Files

> How to connect Blober to Box. Browse folders, upload and download files (including large files over 50 MB), and transfer between Box and other cloud providers.

Box is a cloud storage and file sharing service. In Blober you browse your Box by navigating the folder tree. Box doesn't let you type paths, so you pick a folder or the whole account as a source or destination.

## What you can do

* ✅ Browse folders and files
* ✅ Upload and download files
* ✅ Create folders
* ✅ Delete files and folders
* ✅ Copy and move files within Box

## Prerequisites

* A [Box account](https://www.box.com/) that holds your files (free or paid)
* A free [Box Developer account](https://developer.box.com/) to create and configure the app in the Developer Console
* A Box app with User (OAuth 2.0) auth created in the [Box Developer Console](https://app.box.com/developers/console)

[]()

## Authentication

Blober needs three pieces of information: the **Client ID** and **Client Secret** from the app you create in the Developer Console, plus the **email** of the Box account that holds your files. You paste them into Blober and then sign in to Box to grant access.

**What you'll need from the app:**

| Field                 | What it is                                         |
| --------------------- | -------------------------------------------------- |
| **Client ID**         | A long string that identifies your app             |
| **Client Secret**     | A secret string paired with the Client ID          |
| **Box account email** | The email of the Box account that holds your files |

The email is used to keep separate Box accounts apart when they share the same app. Enter the same email every time you connect.

#### Setup steps

1. [Create a Box Developer account](#1-create-a-box-developer-account) (free trial, needed to create the app)
2. [Create a Box app](#2-create-a-box-app) with **User (OAuth 2.0)** auth
3. [Add the redirect URI](#3-add-the-redirect-uri)
4. [Enable the permissions and copy your credentials](#4-enable-the-permissions-and-copy-your-credentials)
5. [Connect Box in Blober](#5-connect-box-in-blober)

:::tip Prefer a shortcut? Use rclone's public Box app keys Skip app creation and paste rclone's public Box app credentials into Blober instead:

| Field             | Value                              |
| ----------------- | ---------------------------------- |
| **Client ID**     | `d0374ba6pgmaguie02ge15sv1mllndho` |
| **Client Secret** | `grWXGU7zW6034GI54GuswaDQdE30QOfn` |

These belong to a widely shared public app (the one rclone uses), so they work for quick personal transfers. They are **not** the default in Blober - a shared app means shared rate limits, so for anything beyond casual use create your own app and keep the quotas and permissions yours. You still need a Box account and enter its email to authorize. You can confirm these are rclone's real public keys in the rclone source: the [Box backend](https://github.com/rclone/rclone/blob/aba403fa79ea8f4fc9a9e2cbe4c333412e0eb257/backend/box/box.go#L53-L54) defines `rcloneClientID` and the obfuscated `rcloneEncryptedClientSecret`. :::

## Required permissions

In the Box app's **Application Scopes** section, you need **both** of these:

| Checkbox                                      | What it does                                  |
| --------------------------------------------- | --------------------------------------------- |
| **Read all files and folders stored in Box**  | Lets Blober see and download your files.      |
| **Write all files and folders stored in Box** | Lets Blober create, upload, and change files. |

If either is missing, Blober can't connect fully - enable both, then reconnect.

## Setup Guide

### 1. Create a Box Developer account

The Developer Console (where apps are created and configured) is read-only on a standard free Box account - you can't save any changes there. You need a free **Box Developer account** to create and configure the app.

1. Go to [developer.box.com](https://developer.box.com/) and click **Get started** (or sign up at [account.box.com/signup/n/developer](https://account.box.com/signup/n/developer))
2. Enter your name, email address, and a password. Use an email address that is **not already registered** with Box - the developer account needs its own, unused email.
3. Accept the terms and click **Get Started**
4. Confirm your email address to activate the account
5. Open the Developer Console at [app.box.com/developers/console](https://app.box.com/developers/console)

![Box developer signup form showing the Box Developer plan with API access and 10 GB of storage](/kb/_astro/box-developer-account-signup.Bp00AHhm_Z1B97Dd.webp)

#### Developer account vs. a regular Box account

Use a **Box Developer** signup, not the ordinary free "Box Individual" signup. The two differ on the signup page and in the app afterwards:

|                       | Box Developer account                        | Box Individual (free)          |
| --------------------- | -------------------------------------------- | ------------------------------ |
| **Signup plan shown** | "Box Developer", includes **Access to APIs** | "Box Individual", storage only |
| **API access**        | Yes (OAuth 2.0, JWT, Client Credentials)     | No usable API / locked console |
| **Location selector** | No location step                             | May ask to select a location   |
| **Left navigation**   | Shows **Admin console** and **Dev console**  | Does not                       |

![A regular Box (Box Individual) signup for comparison - storage only, no API access](/kb/_astro/box-personal-account-signup.D-coRgh8_Z1Tvbfn.webp)

Once signed in, expand the left navigation - a developer account shows **Admin console** and **Dev console** there; a regular free account does not.

![Box left navigation expanded, showing Admin console and Dev console](/kb/_astro/box-expanded-nav.CULsBX28_Z1Dyyxg.webp)

> **Your files are not affected**
>
> This developer account is only used to create and configure the app. Your files stay in your normal Box account, and that is the account you sign in with when you connect Blober.

> **Is the developer account a trial?**
>
> Box's free developer plan is described as an **initial 30-day evaluation** of developer tools. It is free to start and does not delete your data, but plan to move to a paid **Business** plan for long-term production use. (Enterprise "developer sandboxes" are a separate feature for paid Business plans and above, and have no expiration date.)

### 2. Create a Box app

1. Open the [Box Developer Console](https://app.box.com/developers/console)
2. Click **New App** (top right)
3. Enter an **App Name** (e.g., `Blober`)
4. Under **App Type**, choose **User** - do **not** choose **Server** (Server is for service accounts, can't be used with Blober, and you can't change the type later)
5. Click **Create**

![Create a New App dialog with User selected - users log in with their own Box account](/kb/_astro/box-create-user-app.BzKJvTRS_Z23HOMT.webp)

If the form shows a **Select Method** option, ignore it - it only applies to **Server** apps. A **User** app uses OAuth 2.0 automatically.

### 3. Add the redirect URI

1. Open your app and click the **Configuration** tab
2. Scroll to the **OAuth 2.0 Redirect URI** section
3. Click **Add Redirect URI** and enter exactly: `http://localhost:52847/oauth/box/callback`
4. Click **Save Changes**

![OAuth 2.0 Redirect URIs section on the Configuration tab](/kb/_astro/box-oauth-redirect-uri.B-T1Y7yl_2wRixB.webp)

The redirect URI section is missing?

If there is **no "OAuth 2.0 Redirect URI" section** on the Configuration tab at all, the app was created as the wrong type. Only **User** apps have this field. If you see **Client Credentials Grant** or **JWT** as the authentication method, you created a **Server** app - Box can't convert it, so create a new app and choose **User**.

### 4. Enable the permissions and copy your credentials

1. On the **Configuration** tab, scroll to **Application Scopes** and leave the default permissions selected. They are already correct for Blober - **Read all files and folders stored in Box** and **Write all files and folders stored in Box** are turned on by default.
2. Click **Save Changes**.
3. Click the **App Details** panel (top right).
4. Copy the **Client ID**.
5. Reveal and copy the **Client Secret** (see note below).
6. Keep both somewhere safe - you'll paste them into Blober.

![The Box app Configuration page, showing the Application Scopes and the Client ID and Client Secret in the App Details panel](/kb/_astro/box-config-all.BoVPshkC_ZNWPA3.webp)

> **Accessing your Client Secret**
>
> Box requires **two-factor authentication (2FA)** before it reveals the secret - you can use **email** as your verification method. It may also ask for **phone verification**. Follow the on-screen steps, then copy the secret.

### 5. Connect Box in Blober

1. In Blober, go to **Workflows** => **New Workflow**
2. Select **Box** as source or destination
3. Paste your **Client ID** and **Client Secret**, and enter the **email** of the Box account that holds your files
4. Click **Authorize Box Access** - a browser window opens
5. Sign in with the Box account that holds your files and grant access
6. The browser redirects back to Blober and you're connected

## File Organization

Box has no path-based API. Blober resolves paths by walking the folder tree from the root (`0`) and matching folder names, creating missing folders automatically when uploading.

* Names are **case-insensitive** but **case-preserving** (a folder can't contain both `Photos` and `photos`)
* Folders are created automatically when uploading to a path that doesn't exist yet
* The root of your Box is the top-level "All Files" view (folder id `0`), so selecting the entire drive is simply picking this root

## How Uploads Work

Files of any size your Box plan allows can be transferred to and from Box.

* Files up to **50 MB** upload in one go
* Files **over 50 MB** are split into parts and uploaded in sequence
* **Overwrite-first:** if a file already exists at the destination, it is replaced with the new version - Box never auto-renames
* Parent folders are created automatically if they don't exist

## Rate Limiting

Box applies limits on how many requests you can make per minute. If you hit a limit, a transfer may pause or fail - wait a moment and try again.

## Reconnecting after a while

Box security tokens are valid for **60 days or one use**. If Blober hasn't connected to Box for a while, you may be asked to reconnect - just click **Authorize Box Access** again and sign in. No files are affected.

## Troubleshooting

### "Authentication failed" or 401 errors

* The connection expired. Disconnect Box in Blober and connect again.

### "Box refresh token is invalid or expired - re-authorize"

* The connection needs refreshing. Re-authorize Box in Blober (this doesn't affect your files).

### "Insufficient permission" (403) errors

* The Box app isn't set up to read/write your files. Follow the setup steps and enable **both** the **Read all files and folders stored in Box** and **Write all files and folders stored in Box** checkboxes, then reconnect.
* If the error mentions a specific folder, you may not have access to it in Box itself. Check the folder's sharing in Box.

### Redirect URI errors (`redirect_uri_mismatch` / `redirect_uri_missing`)

If the redirect URI doesn't match, Box shows an **Application Error** page with `Error: redirect_uri_mismatch` and you're never redirected back to Blober.

* Register the exact Redirect URI `http://localhost:52847/oauth/box/callback` in the app's Configuration tab - exact match, no trailing slash, `http` (not `https`), port `52847`, and the full path `/oauth/box/callback`.
* Click **Save Changes** after adding it.
* If you configured multiple redirect URIs, ensure the one Blober uses is among them.

### "Some changes in the configuration could not be saved"

Box shows this when one of the fields on the **Configuration** tab is invalid, so the whole save is rejected. With a redirect URI, the usual causes are:

* **A regular (non-developer) Box account (most common)** - the Developer Console is read-only on standard free accounts. If the console also shows *"Log in or sign up for a Box Developer account to access all of the Developer Console features,"* you need a **free Box Developer account** at [account.box.com/signup/developer](https://account.box.com/signup/developer). Create the app there, then the redirect URI and scopes will save.
* **A trailing slash** on the URI - enter it exactly as `http://localhost:52847/oauth/box/callback` with no trailing `/`.
* **A stray space or character** - type it, don't paste from a source that may add invisible characters.
* **A duplicate URI** - if it's already in the list, remove the duplicate.
* **Another invalid field on the same page** - try saving with only the redirect URI added (leave scopes/CORS unchanged), save, then add the scopes and save again. If something like an empty or malformed CORS entry is the problem, clear it.

### Missing credentials

* Ensure both Client ID and Client Secret are filled in, with no leading/trailing whitespace.

### Files not appearing

* Refresh the file list in Blober.
* If the file was deleted to Box Trash, it won't appear in normal browsing.

### How to revoke access

1. Go to your [Box account settings](https://account.box.com/settings) and find **Authorized Applications**
2. Remove the Blober app
3. In Blober, remove the existing connection

Revoking access invalidates all tokens immediately.

## Limitations

* **No path-based navigation**: Blober walks the folder tree, so you pick a folder (or the whole Box) rather than typing a path.
* **No separate "Shared with me" view**: folders shared with you appear inside your normal file list (see [File Organization](#file-organization)).
* **Files are processed one at a time**: folders are handled after the files they contain.
* **Deletes go to the Box Trash**: deleted items still count toward your quota until the Trash is emptied.
* **Filename rules**: names up to 255 characters, no `\ / < > : " | ? *`, no leading/trailing spaces, and names are case-insensitive (so `Photo` and `photo` can't both exist).

> **Usage limits**
>
> Box limits how much you can transfer per month. If a large transfer stops mid-way, it may be because you reached Box's monthly usage limit. Check your Box plan or try again next month.

> **Terms Compliance**
>
> Your use of Box through Blober is subject to [Box's Terms of Service](https://www.box.com/legal/termsofservice). See our [Terms of Service](/kb/docs/terms-and-privacy/terms-of-service/) for details.