From the official solution for Javascript API-Requests https://developers.blog.box.com/2011/09/28/using-the-box-api-with-javascript/:
Unless you’re lucky enough to be a Box developer like myself, you’ll be hosting your app on a domain other than box.net (or a subdomain thereof). As a result, the Javascript Same Origin Policy is going to prevent us from making Ajax requests to the API from another domain (like localhost, which we’ll be using in this tutorial).
In the tutorial there's this snippet:
$.getJSON("http://query.yahooapis.com/v1/public/yql?q=select%20*%20from%20xml%20where%20url%20%3D%20'https%3A%2F%2Fwww.box.net%2Fapi%2F1.0%2Frest%3Faction%3Dget_ticket%26api_key%3D" + window.api_key + "'&format=json&diagnostics=true",
function(response) {
window.ticket = response.query.results.response.ticket;
window.location.href = 'https://m.box.net/api/1.0/auth/' + ticket;
});
It should be easy to make it a working Javascript API:
function box_api_request(url, api_key, callback) {
$.getJSON("http://query.yahooapis.com/v1/public/yql?q=select%20*%20from%20xml%20where%20url%20%3D%20'" + encodeURI(url) + "%26api_key%3D" + api_key + "'&format=json&diagnostics=true", callback);
}
box_api_request('https://www.box.net/api/1.0/rest?action=get_ticket', '1234MY_API_KEY123', function(response) {
document.write(JSON.stringify(response));
});