Access without an "app"

mbm123 Assuming you're referring to the username/password for your own app (that is, your app should never request or handle Dropbox username/passwords directly), yes, you can have the user log in to your own app, and then send them through the Dropbox app authorization flow to request access to their Dropbox account. Once they do so, you would use the resulting access token/optional refresh token to later make API calls for their account, such as to upload/download files.

(Note that if you only need to access your own account, you could just use your own access/refresh token instead of having each user add the shared folder to their own account and authorize the app to access their account. Note that you shouldn't expose your access/refresh token to other users though, so in this case you should make sure to only keep the token(s) on the server and not exposed to the client.)

Dropbox does not offer the ability to grant an app/access token access to specific existing folder(s) only, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though. 

For reference, the "Dropbox API" currently offers two levels of file access: "app folder" and "full Dropbox". Access tokens for apps with the app folder access type can only access the contents of the special app folder created for the app in the connected account. App folders can't be set to existing folders or combined with shared folders or team folders though.

Access tokens for apps with the full Dropbox access can access anything in the connected account, including shared folders. You can find more information about the different permissions here.