People: Company admins, team admins
Platforms: Browser, Desktop
The Box integration lets users embed Box files in Miro boards. This guide covers the integration's technical implementation, security model, and data handling for admins evaluating or configuring the integration.
Key features
- Live embed: Users can embed Box content into a Miro board as a live iframe.
- Secure: Every board visitor is prompted to log in to the iframe before they can view the embedded content.
- Display options: Users can choose to display embedded content as a live embed or as a bookmark.
- Focus mode: Users can expand a live embed or bookmark into focus mode to view it without distractions.
- Action shortcut: Users can add an action shortcut that opens a dialog for embedding a Box link.
Limitations
- The asset picker isn't available for this integration.
Technical implementation
Miro integrates with Box through the Box REST API. Users authorize access with OAuth 2.0, then link their Box files to a Miro board.
Data flows
- A user who belongs to a team or organization with this feature enabled pastes a Box link onto a Miro board.
- Miro reads the link. If the user hasn't authorized the integration yet, Miro starts the OAuth flow and redirects the user to Box's authorization page.
- After the user grants authorization, Miro's integration service uses the user's access token to call the Box REST API and retrieve the content.
What Box data Miro stores
Miro fetches and stores the following data from pasted Box links:
- Document and file titles
Data retention
Embedded data follows Miro's standard data retention policy for all customer data.
Authentication and authorization
Embedding a Box link on a board requires the user to authorize the integration through Box's OAuth consent screen. Depending on the customer's Box configuration, this may also require a Box admin to approve the integration.
Required authorization scopes
The Box integration requires the following scope:
-
root_readonly— read all files and folders stored in Box.
What's stored in Miro and how
Miro stores two categories of data for this integration: authorization data and unfurling data.
- Authorization data: Miro stores the access token and refresh token in its database for several days. While the authorization is active, Miro automatically refreshes an expired access token using the refresh token, without requiring the user to reauthorize. All data stored for this integration is encrypted at rest using 256-bit AES.
- Unfurling data: Miro stores the titles of assets as part of the Miro board, and stores titles and image references encrypted in an internal service.
Revoking a token
Users can disconnect the Box integration at any time from their Box account settings.
Set up the Box integration
NOTE: Only Miro team admins can install the app. If your Miro organization only allows approved apps, and a regular user pastes a Box link, that user sees an app install request dialog instead.
To install and start using the integration:
- Copy the Box file URL.
- Paste the URL onto your Miro board.
-
What happens next depends on who pasted the link:
- A Miro team admin pastes the link: The app is authorized and installed automatically, and the link unfurls without further action.
- A regular user pastes the link, and the organization only allows approved apps: An app install request dialog opens. After the user requests permission, company admins can follow the App request flow article to approve the request.
Connect a Box account
After the integration is installed and authorized:
- Click Connect on the widget created after pasting the URL on the board. You're redirected to a page asking you to grant Miro access to your Box account.
- Enter your Box account credentials and click Authorize.
- Click Grant access to Box so Miro can access your Box files.
Once connected, your file is embedded on the board with full Box functionality. You can comment, annotate, and review documents directly inside the embed, and changes are reflected in real time so your team can collaborate without leaving the board.
TIP: Open the embed in focus mode to view and interact with the document in a larger, distraction-free view.
Frequently asked questions
Which users can embed Box content into Miro?
The user and the Miro board must meet both of these criteria:
- The user has authorized the Miro Box integration.
- The user has access to the Box content they're trying to embed.
Which users can view the embedded Box content?
Anyone with access to the Miro board and permission from the owner of the embedded content — that is, anyone with view, comment, or edit permissions on the board. Viewers don't need to authorize the integration or hold a Box license to view the embedded content on the board.
Do users have to reauthorize to paste links on other boards?
No, as long as the authorization is still valid (Miro treats an authorization as valid for a month after it's granted). Users can paste Box links on any board, and the content imports normally.
If the board belongs to a different team or organization where this integration isn't enabled, the user can't use it there.
Can I access Box content through Miro that I can't access directly in Box?
No. You can only embed Box content you already have access to — you can't use the integration to see something you couldn't otherwise open in Box. That said, if someone with access has already embedded the content as a static image on a board you share with them, you can view that snapshot even without direct access to the source file. The integration doesn't enforce any additional access policies beyond this; use the Miro board's own sharing settings to restrict who can collaborate. Note that a static image snapshot can't be used to explore the underlying data, open the original file, or change filters.
Where can I find the Miro Data Processing Addendum?
See the Miro Data Processing Addendum.
What's disallowed on public Miro boards?
For security reasons, public boards disable:
- Asset extraction — supported by the Looker, Google Slides, Figma, Power BI, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint integrations.
- Direct asset unfurling (asset instead of live embed) — supported by the Figma integration.