I am developing an app against an Enterprise account that has SSO enabled. When I authenticate, it will accept just my email address if I am already authenticated with Box in my browser session. All looks good, and I get the message via Box “Thanks for logging in”…and that I am free to proceed with my app.
However, when I try to get my auth token, I get the “get_auth_token_error”, and the Box documentation doesn’t give me any details on this, other than saying it is a generic error state.
I’ve tested this with a non-enterprise app (which obviously is not SSO), and all works. Note I am v1 of the Box API
Enterprise Box accounts with SSO enabled need to have the API keys for each application turned on.
The problem turned out that my API key had not been turned on. This is only applicable with SSO enabled enterprise Box accounts. A request has to be made to the Box API team to turn this on.
What confused things was at the same time Box had a known issue with SSO authentication via the API.