Authentication for command line app

This is a general problem with using OAuth in client-side applications, since client-side apps like this can't keep secrets. OAuth 2 addresses this with the "token" or "implicit" flow. When using the token flow (as opposed to the "code" flow), the app doesn't need the app secret to get an access token for the user. You can find more information on the different flows in the documentation here:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

For a client-side app like this, you should use the token flow. Also, you didn't mention if you're using it, but for reference, the official Dropbox Python SDK is mainly meant for server-side apps, where the secret can be kept secret, so it doesn't support the token flow.