Box OAuth2 token exchange needs form-encoded params and the right Content-Type

When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirect_uri if you used it in the authorize step, with identical values in both places.

Context: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalidgranttype or parameter missing from the Box token endpoint. The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.

Source: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalidgranttype or parameter missing from the Box token endpoint. The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.

Verified resolution: When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirect_uri if you used it in the authorize step, with identical values in both places.

Source URL: https://stackoverflow.com/questions/15269989/box-oauth2-invalid-grant-type-parameter-or-parameter-missing