Flag of Ukraine   We stand with the brave people of Ukraine. Stop the war. Find out how you can help.


The @uppy/box plugin lets users import files from their Box account.

A Companion instance is required for the Box plugin to work. Companion handles authentication with Box, downloads the files, and uploads them to the destination. This saves the user bandwidth, especially helpful if they are on a mobile connection.

import Box from '@uppy/box'

uppy.use(Box, {
  // Options

Try it live


This plugin is published as the @uppy/box package.

Install from NPM:

npm install @uppy/box

In the CDN package, the plugin class is available on the Uppy global object:

const { Box } = Uppy

Setting Up

To use the Box provider, you need to configure the Box keys that Companion should use. With the standalone Companion server, specify environment variables:

export COMPANION_BOX_KEY="Box API key"
export COMPANION_BOX_SECRET="Box API secret"

When using the Companion Node.js API, configure these options:

  providerOptions: {
    box: {
      key: 'Box API key',
      secret: 'Box API secret',

You can create a Box App on the Box Developers site.

Things to note:

  • Choose Custom App and select the Standard OAuth 2.0 (User Authentication) app type.
  • Oddly you must enable full write access, or you will get 403 when downloading files

You’ll be redirected to the app page. This page lists the client ID (app key) and client secret (app secret), which you should use to configure Companion as shown above.

The app page has a "Redirect URIs" field. Here, add:


You can only use the integration with your own account initially—make sure to apply for production status on the app page before you publish your app, or your users will not be able to sign in!


Dashboard plugin is recommended as a container to all Provider plugins, including Box. If you are using Dashboard, it comes with all the nessesary styles for Box as well.

⚠️ If you are feeling adventurous, and want to use Box plugin separately, without Dashboard, make sure to include @uppy/provider-views/dist/style.css (or style.min.css) CSS file. This is experimental, not officially supported and not recommended.


The @uppy/box plugin has the following configurable options:

uppy.use(Box, {
  target: Dashboard,
  companionUrl: 'https://companion.uppy.io/',

id: 'Box'

A unique identifier for this plugin. It defaults to 'Box'.

title: 'Box'

Title / name shown in the UI, such as Dashboard tabs. It defaults to 'Box'.

target: null

DOM element, CSS selector, or plugin to mount the Box provider into. This should normally be the @uppy/dashboard plugin.

companionUrl: null

URL to a Companion instance.

companionHeaders: {}

Custom headers that should be sent along to Companion on every request.

companionAllowedHosts: companionUrl

The valid and authorised URL(s) from which OAuth responses should be accepted.

This value can be a String, a Regex pattern, or an Array of both.

This is useful when you have your Companion running on several hosts. Otherwise, the default value should do fine.

companionCookiesRule: 'same-origin'

This option correlates to the RequestCredentials value, which tells the plugin whether to send cookies to Companion.

locale: {}

export default {
  strings: {
    pluginNameBox: 'Box',