## TL;DR

Box returns 401 token_expired when the access token lapses. Refresh it and retry the download; if the refresh token is dead, re-authorize.

## Error

```text
401 Unauthorized: token_expired on file download
```

## Steps

1. Refresh the access token Expected: you have a working token.
2. Retry the download with the new token Expected: it succeeds.
3. If refresh fails, run the OAuth flow again Expected: a fresh pair is issued.
4. Refresh proactively before expiry in long jobs Expected: downloads stop failing mid-run.

## When to use

- Box 401 token_expired on download
- The access token lapsed

## When not to use

- The token was revoked (then re-auth is the only fix)
- The file is gone (that is 404, not 401)

## Tool compatibility

- Box OAuth
- File integrations

## Variant phrasings

### box token_expired

Refresh the access token and retry.

### box 401 download

Same: token lifecycle. Re-auth if refresh fails.

## Why it happens

Long downloads and big sync jobs outlive access tokens. Agents fetch once at startup and never refresh.

## Edge cases

- Box downscoped tokens cannot be refreshed; check how the token was issued
- As-user headers need the right token type

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Qu8Ue6vPN6GmchCBStIXiw