Step 1: Create a Platform App
Sign in to the Box Developer Console.
Select Create Platform App, then choose Platform App as the application type.
Give the app a recognisable name, such as
Your Company — Medialake.Select Integration as the purpose and identify Medialake as the external system. Complete any additional ownership or category fields shown by Box.
Select User Authentication (OAuth 2.0), then select Create App.
Step 2: Add the redirect URL and read-only scope
In the app's Configuration tab, find OAuth 2.0 Redirect URIs.
Enter the Medialake redirect URI exactly as shown:
https://oauth2.medialakeapp.com/box-redirect
Box checks this value exactly, including the scheme, path, and trailing slash.
Under Application Scopes, select only Read all files and folders stored in Box.
Leave Read and write all files and folders stored in Box and all management scopes unselected. Medialake reads Box content but does not create, edit, share, or delete anything in Box.
Save the app configuration.
Step 3: Copy the Client ID and Client Secret
Under OAuth 2.0 Credentials, securely copy the Client ID and Client Secret.
Enter both values on the Box integration settings page in Medialake.
Do not email the Client Secret, add it to a support ticket, or commit it to source control.
If your Box enterprise blocks unpublished or custom apps, a Box administrator must enable the Client ID under Admin Console → Integrations → Platform Apps Manager → User Authentication Apps.
Important Considerations
The Box user who authorizes the connection must be able to view and download the content you want to sync.
The connection can only read content that the authorizing user can already access in Box.
Box refresh tokens expire after 60 days if they are not used. If the connection has been inactive for that long, reconnect it in Medialake.