Skip to main content

Official Box Python SDK

Project description Documentation Status


pip install "boxsdk>=1.5,<2.0"

Important Versioning Note

The production version of the boxsdk package is the 1.5.x release track. The code can be found on Github at <>. This is what will be installed with pip install boxsdk.

The development version of the boxsdk package is the 2.0.0 release track, currently in an alpha release. The code can be found on Github at <>. This isn’t installed by pip by default, but can be installed if specifying a specific version. For example, pip install boxsdk==2.0.0a5. We welcome early testing and feedback on these alpha releases. Note that while we’re still in alpha, version 2.0.0 is subject to change, and there might be breaking changes between alpha releases (e.g. between 2.0.0a2 and 2.0.0a3).

The 1.5.x release track will receive bugfix support at least until the final release of 2.0.0.

We always recommend pinning to a specific version (e.g. by adding boxsdk==1.5.3 in your requirements.txt file), so that you don’t risk accidentally upgrading to a new version and breaking your application. This is particularly important with the upcoming 2.0.0 release. There will be some breaking changes in version 2.0.0, which might break your application if you upgrade without adapting your code first.


The Box API uses OAuth2 for auth. The SDK makes it relatively painless to work with OAuth2 tokens.

Get the authorization url

from boxsdk import OAuth2

oauth = OAuth2(

auth_url, csrf_token = oauth.get_authorization_url('http://YOUR_REDIRECT_URL')

store_tokens is a callback used to store the access token and refresh token. You might want to define something like this:

def store_tokens(access_token, refresh_token):
    # store the tokens at secure storage (e.g. Keychain)

The SDK will keep the tokens in memory for the duration of the Python script run, so you don’t always need to pass store_tokens.

Authenticate (get access/refresh token)

If you navigate the user to the auth_url, the user will eventually get redirected to http://YOUR_REDIRECT_URL?code=YOUR_AUTH_CODE. After getting the code, you will be able to use the code to exchange for an access token and refresh token.

The SDK handles all the work for you; all you need to do is run:

# Make sure that the csrf token you get from the `state` parameter
# in the final redirect URI is the same token you get from the
# get_authorization_url method.
assert 'THE_CSRF_TOKEN_YOU_GOT' == csrf_token
access_token, refresh_token = oauth.authenticate('YOUR_AUTH_CODE')

Create an authenticated client

from boxsdk import Client

client = Client(oauth)

And that’s it! You can start using the client to do all kinds of cool stuff and the SDK will handle the token refresh for you automatically.


Get user info

me = client.user(user_id='me').get()
print 'user_login: ' + me['login']

Get folder info

root_folder = client.folder(folder_id='0').get()
print 'folder owner: ' + root_folder.owned_by['login']
print 'folder name: ' + root_folder['name']

Get items in a folder

items = client.folder(folder_id='0').get_items(limit=100, offset=0)

Create subfolder

# creates folder structure /L1/L2/L3

Get file name


Rename an item


Move an item


Get content of a file


Lock/unlock a file



# Get events, stream_position='now')

# Generate events using long polling
for event in
    pass  # Do something with the event

# Get latest stream position


# Get metadata

# Create metadata
client.file(file_id='SOME_FILE_ID').metadata().create({'key': 'value'})

# Update metadata
metadata = client.file(file_id='SOME_FILE_ID').metadata()
update = metadata.start_update()
update.add('/key', 'new_value')


The Client class and all Box objects also have an as_user method.

as-user returns a copy of the object on which it was called that will make Box API requests as though the specified user was making it.

See for more information about how this works via the Box API.

# Logged in as admin, but rename a file as SOME USER
user = client.user(user_id='SOME_USER_ID')

# Same thing, but using file's as_user method

Other Requests

The Box API is continually evolving. As such, there are API endpoints available that are not specifically supported by the SDK. You can still use these endpoints by using the make_request method of the Client.

# Returns a Python dictionary containing the result of the API request
json_response = client.make_request(
    client.get_url('metadata_templates', 'enterprise', 'customer', 'schema'),

make_request() takes two parameters:

  • method -an HTTP verb like GET or POST
  • url - the URL of the requested API endpoint

The Client class and Box objects have a get_url method. Pass it an endpoint to get the correct URL for use with that object and endpoint.

Box Developer Edition

The Python SDK supports your Box Developer Edition applications.

Developer Edition support requires some extra dependencies. To get them, simply

pip install boxsdk[jwt]

Instead of instantiating your Client with an instance of OAuth2, instead use an instance of JWTAuth.

from boxsdk import JWTAuth

auth = JWTAuth(

access_token = auth.authenticate_instance()

from boxsdk import Client

client = Client(auth)

This client is able to create application users:

ned_stark_user = client.create_user('Ned Stark')

These users can then be authenticated:

ned_auth = JWTAuth(
ned_client = Client(ned_auth)

Requests made with ned_client (or objects returned from ned_client’s methods) will be performed on behalf of the newly created app user.

Other Auth Options

For advanced uses of the SDK, two additional auth classes are provided:

  • CooperativelyManagedOAuth2: Allows multiple auth instances to share tokens.
  • RemoteOAuth2: Allows use of the SDK on clients without access to your application’s client secret. Instead, you provide a retrieve_access_token callback. That callback should perform the token refresh, perhaps on your server that does have access to the client secret.
  • RedisManagedOAuth2: Stores access and refresh tokens in Redis. This allows multiple processes (possibly spanning multiple machines) to share access tokens while synchronizing token refresh. This could be useful for a multiprocess web server, for example.

Other Client Options

Logging Client

For more insight into the network calls the SDK is making, you can use the LoggingClient class. This class logs information about network requests and responses made to the Box API.

>>> from boxsdk import LoggingClient
>>> client = LoggingClient()
>>> client.user().get()
GET {'headers': {u'Authorization': u'Bearer ---------------------------kBjp',
             u'User-Agent': u'box-python-sdk-1.5.0'},
 'params': None}
{"type":"user","id":"..","name":"Jeffrey Meadows","login":"..",..}
<boxsdk.object.user.User at 0x10615b8d0>

For more control over how the information is logged, use the LoggingNetwork class directly.

from boxsdk import Client
from import LoggingNetwork

# Use a custom logger
client = Client(oauth, network_layer=LoggingNetwork(logger))

Developer Token Client

The Box Developer Console allows for the creation of short-lived developer tokens. The SDK makes it easy to use these tokens. Use the get_new_token_callback parameter to control how the client will get new developer tokens as needed. The default is to prompt standard input for a token.

Development Client

For exploring the Box API, or to quickly get going using the SDK, the DevelopmentClient class combines the LoggingClient with the DeveloperTokenClient.



Developer Setup

Create a virtual environment and install packages -

mkvirtualenv boxsdk
pip install -r requirements-dev.txt


Run all tests using -


The tox tests include code style checks via pep8 and pylint.

The tox tests are configured to run on Python 2.6, 2.7, 3.3, 3.4, 3.5, 3.6, and PyPy2.7 (our CI is configured to run PyPy2.7 tests on PyPy2.7 5.8.0).


Need to contact us directly? Email and be sure to include the name of this project in the subject. For questions, please contact us directly rather than opening an issue.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
boxsdk-1.5.5-py2.py3-none-any.whl (69.2 kB) Copy SHA256 hash SHA256 Wheel py2.py3 Sep 19, 2017
boxsdk-1.5.5.tar.gz (93.4 kB) Copy SHA256 hash SHA256 Source None Sep 19, 2017

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page