Best practice for using Dropbox (Java) API

Hi, Thierry. I'm the one who was responding on Twitter. Thanks for writing in. :-)

Our general guidance is that when you’re releasing your app to be used by users, you can certainly embed your app key and secret in the app, so that the app will work and let them link it to their accounts without any additional work. You may choose to obfuscate the key/secret to at least make it difficult for someone to extract them from your app.

On the other hand, if you release the code itself, for example on GitHub, etc., you should not include your app key/secret. This way, if anyone forks the code (in essence, making their own version of the app), they will have to get their own app key. That lets the Dropbox API distinguish between the different versions of the apps, and in case one of them misbehaves, any action taken will only affect the one misbehaving version.

I hope this helps clear things up.