The documentation (http://developers.box.com/oauth/) suggests using POSTMAN or curl.
in this example, the clientID is 123, secret code is 456 and so on.
I am using Postman. In a prior step, I have obtained an access code via: https://www.box.com/api/oauth2/authorize?response_type=code&client_id=123 let's say the response is xyz
In the next step, I use POSTMAN to issue a POST command (urlencoded) https://www.box.com/api/oauth2/token?grant_type=authorization_code&client_id=123&client_secret=456&code=xyz
I do all of this within 30 seconds of obtaining the code in step 1.
The error is {"error":"invalid_request","error_description":"Invalid grant_type parameter or parameter missing"}
Alternatives I've tried: adding a redirect_uri, adding a response_type, only encoding the body with %D~% brackets.
I notice at least 5 similar questions for Box on stackoverflow, none with acknowledged solutions, though none with POSTMAN (which the documentation suggests).
What is the resolution for obtaining an access token via POSTMAN for the BOX API?
I believe the problem with the /token request is that you're putting the parameters in the query string. These should instead be included in the POST request body.
来源：https://stackoverflow.com/questions/15437525/box-api-oauth2-acces-token-request-error-invalid-grant-type-parameter-or-parame