box-rclone-binderlisted

# box-rclone-binder > Governing principle (full text in the repo's `PHILOSOPHY.md`): **the multi-host failure is the > auth model, not the deploy script.** Box's OAuth refresh_token is single-use and rotating, so > sharing one across N machines guarantees `invalid_grant`. The fix is to remove the shared > rotating secret entirely (server auth), then make deploy/health idempotent on top of that. ## When to use / when to stop - **Use** when you must bind ONE Box account to TWO OR MORE servers via rclone and keep it alive unattended (auto-refresh, expiry self-heal, multi-host consistency). - **Single server only?** Plain `rclone config` is enough, you do not need this. - **Not Box, or not rclone?** Out of scope. - **Generic cron/systemd templating?** Route elsewhere; this owns the Box+rclone seam specifically. ## The one decision that defines the tool: auth mode Pick with `box-binder doctor`, then set `auth_mode` in `machines.yaml`: | mode | refresh_token? | when | how it stays alive | |---|---|---|---| | **jwt** (default) | none | enterprise Box + Admin authorize | rclone `tokenRenewer` re-mints locally on each host | | **ccg-native** | none | enterprise + rclone proves CCG works | rclone renews natively | | **ccg-mint** | none | enterprise, CCG-native unproven | external mint timer (<60 min) re-mints access token | | **oauth-broker** | one master only | personal Box, no Admin | single flock'd master refreshes, distributes access-only blobs | Server-auth modes give eac