title: box.com api OAuth authentication
body: <p>Either I'm dense, or the docs assume I already know what they're telling me, but I need some clarification on doing authentication for a box.com app. I really don't understand whate's going on. As I read it:</p>
  
  <ol>
  <li>the app running on the user's machine sends a request to Box, including all the little secrets (Which aren't all that secret any more if the user knows how to read the code).</li>
  <li>The user is directed to the Box login page, which then sends the user to my server (with no page specified) attaching an authentication code. </li>
  <li>The app somehow magically gets that code back from my server and sends a request to Box for the access token.</li>
  <li>Box sends the access token to my server?</li>
  <li>The app again magically gets the access token from my server and sends its APT requests.</li>
  </ol>
  
  <p>Obviously I got lost somewhere. </p>
  
  <p>And, why do I have to have a server involved in the process? The article on making a JavaScript app refers to a direct request for a token. Is there documentation on that somewhere?</p>