
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
box-node-sdk
Advanced tools
Starting with v10 of the SDK, we’ve introduced a new generated codebase designed to enhance your experience with the Box API.
It is currently available on the sdk-gen branch.
v10 is targeted at new users of Box Node SDK and users already working with the generated Box Typescript SDK previously available under the Box Typescript SDK Gen repository.
For users of v3 of the Box Node SDK, no action is required at this time — we’ll be providing an upcoming v4 release that will include code from both versions for a smooth migration path. To avoid unintentional upgrades, pin your version to box-node-sdk: ^3.8.2 in your package.json.
For full guidance on SDK versioning, see the Box SDK Versioning Guide.
| Scenario | Recommended Version | Example Dependency |
|---|---|---|
| Creating a new application | Use v10 | npm install box-node-sdk@10 |
| Existing app using box-sdk-gen artifact | Upgrade to v10 | npm install box-node-sdk@10 |
| Existing app using box-node-sdk and planning to use new features | Wait for v4 to start migration process | TBD |
| Existing app using box-node-sdk and not planning changes | Stay on your current version | npm install box-node-sdk@^3.8.2 |
We are excited to introduce the stable release of the latest generation of Box Node SDK, designed to elevate the developer experience and streamline your integration with the Box Content Cloud.
With this SDK, you’ll have access to:
Embrace the new generation of Box SDKs and unlock the full potential of the Box Content Cloud.
If you are using npm:
npm install box-node-sdk@<version>
If you use yarn, please do this instead:
yarn add box-node-sdk@<version>
Where VERSION is the version of the SDK you want to use. The next generation of the SDK starts with version 10.0.0.
To get started with the SDK, get a Developer Token from the Configuration page of your app in the Box Developer Console. You can use this token to make test calls for your own Box account.
The SDK provides an DeveloperTokenAuth class, which allows you to authenticate using your Developer Token.
Use instance of DeveloperTokenAuth to initialize Client object.
Using Client object you can access managers, which allow you to perform some operations on your Box account.
The example below demonstrates how to authenticate with Developer Token and print names of all items inside a root folder.
const { BoxClient, BoxDeveloperTokenAuth } = require('box-node-sdk');
async function main(token) {
let auth = new BoxDeveloperTokenAuth({ token });
let client = new BoxClient({ auth });
let entries = (await client.folders.getFolderItems('0')).entries;
entries.forEach((entry) => console.log(entry));
}
main('INSERT YOUR DEVELOPER TOKEN HERE');
In order to use in browser make sure you include the lib/bundle.js file and then you can access the classes like so:
const { BoxClient, BoxDeveloperTokenAuth } = window['box-node-sdk'];
See example.html for an example website using this SDK.
To run the example locally:
npx serve -p 3000 in the project directory.http://localhost:3000 is allowlisted in CORS Domains of your application.http://localhost:3000/example.html.Browse the docs or see API Reference for more information.
This SDK works in modern browsers that support ES6+ features. It seamlessly integrates with frontend frameworks like ReactJS, Angular, and NextJS. Check out our example below:
Upgrading from our legacy SDKs to the new generation SDKs is a straightforward process. See our migration guide and changelog for more information.
To run integration tests locally you will need a Custom App created in the Box Developer
Console with Server Authentication (with JWT) selected as authentication method.
Once created you can edit properties of the application:
App Access Level select App + Enterprise Access. You can enable all Application Scopes.Advanced Features enable Make API calls using the as-user header and Generate user access tokens.Now select Authorization and submit application to be reviewed by account admin.
Configuration tab and in the bottom in the section App Settings
download your app configuration settings as JSON.base64 -i path_to_json_fileJWT_CONFIG_BASE_64 with base64 encoded jwt configuration fileBOX_FILE_REQUEST_ID with ID of file request already created in the user account, BOX_EXTERNAL_USER_EMAIL with email of free external user which not belongs to any enterprise and BOX_EXTERNAL_USER_ID with its ID.WORKFLOW_FOLDER_ID with the ID of the Relay workflow that deletes the file that triggered the workflow. The workflow should have a manual start to be able to start it from the API.APP_ITEM_ASSOCIATION_FILE_ID to the ID of the file with associated app item and APP_ITEM_ASSOCIATION_FOLDER_ID to the ID of the folder with associated app item.APP_ITEM_SHARED_LINK to the shared link associated with app item.SLACK_AUTOMATION_USER_ID to the ID of the user responsible for the Slack automation, SLACK_ORG_ID to the ID of the Slack organization and SLACK_PARTNER_ITEM_ID to the ID of the Slack partner item.Need to contact us directly? Browse the issues tickets! Or, if that doesn't work, file a new one and we will get back to you. If you have general questions about the Box API, you can post to the Box Developer Forum.
Copyright 2023 Box, Inc. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
Official SDK for Box Platform APIs
The npm package box-node-sdk receives a total of 76,191 weekly downloads. As such, box-node-sdk popularity was classified as popular.
We found that box-node-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.