Minimal Downscoped Access Token: Profile Only
Could you add the minimum required permission to the downscope feature that allows access to the user's own profile only?
https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/
ex) profile_readonly
If third-party services can use a token with the least privilege to verify the user's login and EID,
it will help in building a more secure service.
1
vote
Anonymous
shared this idea