This means that the token you got from box didn't have a refresh token so rclone couldn't refresh it.
This might be a setting in your client_id that needs fixing. Google drive does this when your client_id isn't set to public but I'm not sure about box. That should give you an area to look at.