diff --git a/internal/token.go b/internal/token.go
index 8bb467e..2ed6bd3 100644
--- a/internal/token.go
+++ b/internal/token.go
@@ -106,6 +106,7 @@ var brokenAuthHeaderProviders = []string{
 	"https://oauth.sandbox.trainingpeaks.com/",
 	"https://oauth.trainingpeaks.com/",
 	"https://www.strava.com/oauth/",
+	"https://app.box.com/",
 }
 
 // providerAuthHeaderWorks reports whether the OAuth2 server identified by the tokenURL