When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirect_uri if you used it in the authorize step, with identical values in both places.

Context: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalid_grant_type or parameter missing from the Box token endpoint. The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.