feat: add Platform Account authentication

README.md

@@ -112,7 +112,7 @@ To sign out from the current environment, run:
 box logout
 ```
 
-This revokes the access token on Box and clears the local token cache. For OAuth, run `box login` to authorize again. For CCG and JWT, a new token is fetched automatically on the next command. Use `-f` to skip the confirmation prompt, or `--on-revoke-failure=clear` / `--on-revoke-failure=abort` to control behavior when token revocation fails. See [`box logout`](docs/logout.md) for full details.
+This revokes the access token on Box and clears the local token cache. For OAuth, run `box login` to authorize again. For CCG, JWT, and Platform Account, a new token is fetched automatically on the next command. Use `-f` to skip the confirmation prompt, or `--on-revoke-failure=clear` / `--on-revoke-failure=abort` to control behavior when token revocation fails. See [`box logout`](docs/logout.md) for full details.
 
 ## Secure Storage
 
@@ -233,7 +233,7 @@ Avatar URL: 'https://app.box.com/api/avatar/large/77777'
 * [`box storage-policies`](docs/storage-policies.md) - List storage policies
 * [`box tasks`](docs/tasks.md) - Manage tasks
 * [`box terms-of-service`](docs/terms-of-service.md) - List terms of services for your enterprise
-* [`box tokens`](docs/tokens.md) - Get a token. Returns the service account token by default
+* [`box tokens`](docs/tokens.md) - Get a token. Returns the service account token by default.
 * [`box trash`](docs/trash.md) - List all items in trash
 * [`box update`](docs/update.md) - Update the BoxCLI using GitHub
 * [`box users`](docs/users.md) - List all Box users

docs/authentication.md

@@ -8,6 +8,7 @@ overview of how the Box API handles authentication.
   - [Developer Token](#developer-token)
   - [Server Auth with JWT](#server-auth-with-jwt)
   - [Server Auth with CCG](#server-auth-with-ccg)
+  - [Platform Account Auth](#platform-account-auth)
   - [OAuth 2.0 Login (`box login`)](#oauth-20-login-box-login)
     - [Option 1: Official Box CLI App](#option-1-official-box-cli-app)
     - [Option 2: Your Own Platform App](#option-2-your-own-platform-app)
@@ -27,6 +28,7 @@ Use this quick comparison to choose the right method:
 | OAuth 2.0 (`box login`) | Interactive user workflows | Yes (browser auth) | `box login -d` (quick start) |
 | JWT | Server-to-server automation | No | `box configure:environments:add /path/to/config.json` |
 | CCG | Server-to-server automation (no keypair) | No | `box configure:environments:add /path/to/config.json --ccg-auth` |
+| Platform Account | Automation that must always act as one Platform Account | No | `box configure:environments:add /path/to/config.json --platform-account-auth` |
 
 ### Developer Token
 
@@ -123,6 +125,62 @@ By default, CCG authenticates as the Service Account. To make API calls as an Ap
 box configure:environments:add /path/to/config.json --ccg-auth --ccg-user "USER_ID"
 ```
 
+### Platform Account Auth
+
+Platform Account authentication allows your application to authenticate as a single **Platform Account**. Like JWT, it uses a public/private key pair and does not require user interaction, but every command always runs as the Platform Account from the config file.
+
+**Key characteristics:**
+
+- The identity is fixed by the config file. Switching users is not supported: the `--as-user` flag, a default As-User (`box configure:environments:switch-user`), the `as-user` field in bulk input, and `box tokens:get --user-id` are rejected.
+- Tokens cannot be downscoped or exchanged, so `box tokens:exchange` is not supported.
+- Tokens are requested and refreshed automatically, like for JWT.
+- An Enterprise ID is not required.
+
+**Setup:**
+
+1. Download the credentials file for the Platform Account. It has the following structure:
+
+```json
+{
+  "boxAppSettings": {
+    "clientID": "your_client_id",
+    "clientSecret": "your_client_secret",
+    "appAuth": {
+      "publicKeyID": "your_public_key_id",
+      "privateKey": "-----BEGIN ENCRYPTED PRIVATE KEY-----\n...\n-----END ENCRYPTED PRIVATE KEY-----\n",
+      "passphrase": "your_passphrase"
+    }
+  },
+  "userID": "your_platform_account_user_id"
+}
+```
+
+2. Add the environment with the `--platform-account-auth` flag:
+
+```bash
+box configure:environments:add /path/to/config.json --platform-account-auth --name 'YOUR_ENVIRONMENT_NAME'
+```
+
+> **Tip:** If you keep the private key in a separate file, remove `privateKey` from the config file and pass `--private-key-path /path/to/private_key.pem`.
+
+3. If you have multiple environments, set the active one:
+
+```bash
+box configure:environments:set-current
+```
+
+To check which token the CLI uses, run `box tokens:get`. It returns a token for the Platform Account.
+
+**Updating the credentials:**
+
+To use a new credentials file, for example after rotating the key pair, point the environment to it:
+
+```bash
+box configure:environments:update 'YOUR_ENVIRONMENT_NAME' --config-file-path /path/to/new_config.json
+```
+
+The Client ID and the Platform Account ID are read again from the new file. The `--user-id` flag is not supported for Platform Account environments.
+
 ### OAuth 2.0 Login (`box login`)
 
 The `box login` command authenticates you with Box using OAuth 2.0. It starts a local callback server, opens your browser for authorization, and stores the resulting tokens in a named environment.

docs/configure.md

@@ -15,12 +15,12 @@ Configure the Box CLI
 
 ## `box configure:environments:add PATH`
 
-Add a new Box environment from a Box app config file (JWT or CCG).
+Add a new Box environment from a Box app config file (JWT, CCG, or Platform Account).
 
 ```
 USAGE
   $ box configure:environments:add PATH [--no-color] [-h] [-v] [-q] [--private-key-path <value>] [--set-as-current] [-n <value>]
-    [--ccg-user <value> --ccg-auth]
+    [--ccg-user <value> [--ccg-auth | --platform-account-auth]]
 
 ARGUMENTS
   PATH
@@ -30,6 +30,7 @@ ARGUMENTS
       CCG: create this JSON file yourself using values from your application
       in Developer Console (Client ID and Client Secret from Configuration tab,
       Enterprise ID from General Settings tab).
+      Platform Account: use the credentials file downloaded for the Platform Account.
 
 FLAGS
   -h, --help
@@ -58,14 +59,21 @@ FLAGS
   --no-color
       Turn off colors for logging
 
+  --platform-account-auth
+      Add a Platform Account environment. Commands will always run as the Platform Account from the config file; switching
+      users, --as-user and token downscoping are not supported.
+      Use the credentials file downloaded for the Platform Account.
+      Required fields: boxAppSettings.clientID, boxAppSettings.clientSecret, boxAppSettings.appAuth.publicKeyID,
+      boxAppSettings.appAuth.privateKey (or --private-key-path), boxAppSettings.appAuth.passphrase, userID.
+
   --private-key-path=<value>
       Provide a path to application private key
 
   --set-as-current
       Set this new environment as your current environment
 
 DESCRIPTION
-  Add a new Box environment from a Box app config file (JWT or CCG).
+  Add a new Box environment from a Box app config file (JWT, CCG, or Platform Account).
   Open your application in Box Developer Console to get/create config data:
   https://cloud.app.box.com/developers/console
 
@@ -78,6 +86,8 @@ EXAMPLES
   $ box configure:environments:add ./config.json --name production --set-as-current
 
   $ box configure:environments:add ./config.json --ccg-auth --name ci-bot
+
+  $ box configure:environments:add ./platform_account_config.json --platform-account-auth --name my-agent
 ```
 
 _See code: [src/commands/configure/environments/add.js](https://github.com/box/boxcli/blob/v4.10.1/src/commands/configure/environments/add.js)_

docs/logout.md

@@ -4,7 +4,7 @@
 Revoke the access token and clear local token cache.
 
 For OAuth, run `box login` to authorize again.
-For CCG and JWT, a new token is fetched automatically on the next command.
+For CCG, JWT, and Platform Account, a new token is fetched automatically on the next command.
 
 Use -f and --on-revoke-failure=clear or --on-revoke-failure=abort to skip the interactive prompt.
 
@@ -32,7 +32,7 @@ DESCRIPTION
   Revoke the access token and clear local token cache.
 
   For OAuth, run `box login` to authorize again.
-  For CCG and JWT, a new token is fetched automatically on the next command.
+  For CCG, JWT, and Platform Account, a new token is fetched automatically on the next command.
 
   Use -f and --on-revoke-failure=clear or --on-revoke-failure=abort to skip the interactive prompt.
 ```

docs/tokens.md

@@ -1,15 +1,17 @@
 `box tokens`
 ============
 
-Get a token. Returns the service account token by default
+Get a token. Returns the service account token by default.
+
+Not supported for Platform Account environments.
 
 * [`box tokens:exchange SCOPE`](#box-tokensexchange-scope)
 * [`box tokens:get`](#box-tokensget)
 * [`box tokens:revoke TOKEN`](#box-tokensrevoke-token)
 
 ## `box tokens:exchange SCOPE`
 
-Get a token. Returns the service account token by default
+Get a token. Returns the service account token by default.
 
 ```
 USAGE
@@ -30,14 +32,16 @@ FLAGS
       --no-color           Turn off colors for logging
 
 DESCRIPTION
-  Get a token. Returns the service account token by default
+  Get a token. Returns the service account token by default.
+
+  Not supported for Platform Account environments.
 ```
 
 _See code: [src/commands/tokens/exchange.js](https://github.com/box/boxcli/blob/v4.10.1/src/commands/tokens/exchange.js)_
 
 ## `box tokens:get`
 
-Generate a new access token. Returns a service account token for the default environment unless --user-id is specified.
+Generate a new access token. Returns a service account token for the default environment unless --user-id is specified. For Platform Account environments, returns a token for the Platform Account.
 
 ```
 USAGE
@@ -52,7 +56,7 @@ FLAGS
 
 DESCRIPTION
   Generate a new access token. Returns a service account token for the default environment unless --user-id is
-  specified.
+  specified. For Platform Account environments, returns a token for the Platform Account.
 
 EXAMPLES
   $ box tokens:get

package.json

@@ -38,6 +38,7 @@
 		"@oclif/table": "^0.5.8",
 		"@octokit/rest": "^22.0.0",
 		"archiver": "^8.0.0",
+		"bluebird": "^3.7.2",
 		"box-node-sdk": "^4.11.1",
 		"chalk": "^2.4.1",
 		"cli-progress": "^2.1.0",