# box auth.md

You are an agent, and you want to use box: a person's cloud Linux desktop, served as a remote MCP server at `https://mcp.box.simular.ai/mcp` (Streamable HTTP). This page explains how to get credentials for it.

box has **no agent self-registration**. There is no anonymous, email or identity-assertion (ID-JAG) registration. Every credential comes from a person with a Simular account, in one of two ways.

## Option 1: OAuth (MCP authorization). Use this when your client can open a browser.

1. **Discover.** Call `https://mcp.box.simular.ai/mcp` without a token. The 401 response's `WWW-Authenticate` header names the protected-resource metadata: `https://mcp.box.simular.ai/.well-known/oauth-protected-resource/mcp` (RFC 9728). Its `authorization_servers` entry is box's authorization server, and `https://mcp.box.simular.ai/.well-known/oauth-authorization-server` (RFC 8414) lists its endpoints.
2. **Register your client.** Use the metadata's `registration_endpoint` (dynamic client registration, RFC 7591), or a client ID metadata document (`client_id_metadata_document_supported`) where your client has one.
3. **Ask the person to sign in.** Use the authorization code flow with PKCE (`S256`), the scope `boxes`, and `resource=https://mcp.box.simular.ai/mcp`. The person signs in with their Simular account and approves you.
4. **Use the token.** Send `Authorization: Bearer <access_token>` on every MCP request. Refresh it with the `refresh_token` grant. Revoke it at the metadata's `revocation_endpoint` when you are done.

## Option 2: a personal key. Use this when your client can't sign in.

Ask the person to create a key at https://box.simular.ai/keys (under **Keys and devices**). It is shown once and starts with `cb_`. Send it as `Authorization: Bearer cb_...`. Never ask for it in a shared chat, and never write it into files the person didn't ask for.

## Then

Call `tools/list` for the tools, which vary by box. The setup guide for each app is at https://box.simular.ai/docs/mcp.md. The server card is at https://box.simular.ai/.well-known/mcp/server-card.json.