# Box OAuth2 token exchange needs form-encoded params and the right Content-Type

## TL;DR

When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirect_uri if you used it in the authorize step, with identical values in both places. Context: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalid_grant_type or parameter missing from the Box token endpoint.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.