Box is an enterprise content-management platform for files, folders, and collaboration. Use OAuth when access should follow a Box user, or a server-to-server app when approved automation needs its own identity.
This guide prepares Box for any compatible MCP client.
Choose a connection method
Choose OAuth when the MCP connection should act as a Box user. Choose a server-to-server application only for reviewed unattended automation. Box's authentication guide explains the supported app and token models.
Recommended: OAuth app with a scoped Box user
Create a test folder and a Box user who can access only that folder. OAuth is preferred because the connection follows the user's Box permissions.
- In the Box Developer Console, create the OAuth application required by your MCP client.
- Register the exact redirect URI. For Dome, use
https://api.domesystems.ai/oauth/callback. - Select the minimum application scopes and restrict the app to the intended enterprise when prompted.
- Ask the Box enterprise admin to authorize the custom app if the enterprise requires admin approval.
- Authorize as the test user, read a known file, and verify an unshared folder cannot be read.
Alternative: Server-to-server app
Use Box server-to-server authentication only for a reviewed, non-interactive automation with an enterprise-owned service account. It is not a shortcut around user or admin approval. Follow Box's authentication guide and keep the service account's collaborations limited to the required folders.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Box MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Box MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Box boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If the app cannot see expected files, check folder collaboration and enterprise app authorization before adding broader scopes. Redirect URI values must match byte-for-byte.
Next steps
Use the approved Box OAuth application in the MCP client or governed-agent deployment of your choice. Keep the client scoped to the test user and approved content boundary established above.
