Cut the Clutter: Test Ignore Files Feature - sign up to become a beta tester here!
Forum Discussion
Solved
Dropbox Java client for Android: how to refresh token?
My app just needs to upload a backup file to a dropbox account from mine, so the access must be off-line (no prompting to the user, that would be confusing). This is carried out when the user finishes inputting data. I previously used the API with the following code (Java SDK):
DbxRequestConfig config = DbxRequestConfig.newBuilder( getPackageName() ).build();
DbxClientV2 client = new DbxClientV2( config, getString( R.string.dropbox_token ) );
client.files()
.uploadBuilder( toPath )
.withMode( WriteMode.OVERWRITE )
.uploadAndFinish( in );
But now this does not work anymore, or better speaking, it works but the token expires, so it only works once. I've looked the docs for the Java SDK, but there doesn't seem to be a simple example for offline access.
What I tried so far:
- I obtained an access token, that allows the initial authentication.
- I substituted the generated short-lived token with an access token. But this does not work by itself.
- There is a promising method in the client that refreshes a token, so I tried calling it and creating a new client, before uploading the file:
try {
DbxRefreshResult result = client.refreshAccessToken();
DbxCredential credentials = new DbxCredential(
getString( R.string.dropbox_token ),
Long.MAX_VALUE,
result.getAccessToken(),
getString( R.string.dropbox_key ),
getString( R.string.dropbox_secret ) );
client = new DbxClientV2( config, credentials );
} catch (DbxException e) {
System.err.println( "Error refreshing token: " + e.getMessage());
}
The refreshing apparently works (no errors, at least), but then the upload fails with a new error: invalid_access_token.
So, should I create a new client with the refresh token or not? Am I refreshing the token correctly?
Okay, solved.
I summarized the process in the following notes:
Dropbox client API
1Cloud backup with the Dropbox API
Until september 2022, it was possible to generate an access token, use it when creating the client, and don’t worry again about authorization. This is not possible anymore, so in order to create a backup system the most similar access system is PKCE for an offline app.
2Refresh token
After creating the app in the App Console, ignore the “generate token” option since this only creates a token valid for about 4 hours (though there is no note about this). Keep the PKCE activated.
Now, paste the following line in the address bar of your browser:
https://www.dropbox.com/oauth2/authorize?token_access_type=offline&response_type=code&client_id=<App key>
You need to substitute <App Key> for the application key that appears in the App Console. Keep the App Secret code near, as well.
You will authorize the app only once through that URL, and the answer will be the so called authorization code, an hexadecimal code. You need to take note of this code.
3Obtaining the refresh token
Now you have to open a terminal and paste there:
curl https://api.dropbox.com/oauth2/token -d code=<Authorization Code> -d grant_type=authorization_code -u <App key>:<App secret>You have to substitute <Authorization Code> with the last obtained token, <App Key> with the App Key and <App Secret> with the App Secret, these latter appearing in the App Console.
The answer will be a JSON piece of data similar to the following one:
{ "access_token":"sl...", "token_type": "bearer", "expires_in": 14400, "refresh_token": "oDfT54975DfGh12345KlMnOpQrSt01a", "scope": "account_info.read files.content.read ...", "uid": "123...", "account_id": "dbid:AB..." }The access token would be valid for the app to access Dropbox for 4 hours (expires_in). Note the “sl.” prefix (Short Lived). The important code here is refresh_token, which is a permanent token that you can access Dropbox with.
4Using the Java API
The problem with the API is that it is not always intuitive to use. With the PKCE access system, we only need to change the Dropbox client object in respect to what appears in the documentation.
final String APP_PACKAGE = OWNER.getPackageName(); final DbxRequestConfig CONFIG = DbxRequestConfig.newBuilder( APP_PACKAGE ).build(); final DbxCredential CREDENTIALS = new DbxCredential( "", 0L, <dropbox refresh token>, <app key>, <app secret> ); this.DBOX_CLIENT = new DbxClientV2( this.CONFIG, CREDENTIALS );The remaining code is left untouched.
19 Replies
Hi baltasarq,
Take a look on a nearby thread. It's almost the same (different languages, but the same idea).
- Greg-DB
Dropbox Community Moderator
[Cross-linking for reference: https://stackoverflow.com/questions/77059304/dropbox-java-client-for-android-how-to-refresh-token ]
Dropbox is no longer offering the option for creating new long-lived access tokens. Dropbox is now issuing short-lived access tokens (and optional refresh tokens) instead of long-lived access tokens. You can find more information on this migration here.
Apps can still get long-term access by requesting "offline" access though, in which case the app receives a "refresh token" that can be used to retrieve new short-lived access tokens as needed, without further manual user intervention. Refresh tokens do not expire and can be store and re-used repeatedly. While you do need to use the OAuth app authorization flow to get a refresh token, this only needs to be done once per account. You can find more information in the OAuth Guide and authorization documentation. There's a basic outline of processing this flow in this blog post which may serve as a useful example.The official Dropbox Java SDK can actually handle the process for you automatically, as long as you supply the necessary credentials, e.g., as shown retrieved in the examples here. For instance, for a client-side app, such as a desktop app, you should use the PKCE flow, e.g., as shown here. That allows you to make and save a DbxCredential with a refresh token as shown here. With that, you can make API calls like shown here.
For Android apps using the official Dropbox Java SDK, you should use the updated authorization functionality, starting with thestartOAuth2PKCEmethod. You can find an example app here. For instance, you can see where that starts in the code here and how the result is handled here. When you use that functionality as shown, the SDK will then handle the refresh process for you automatically. The problem is that I'm not using the HTTP API, I have to refer myself to the Java SDK API, and I don't understand how the possible HTTP messages should be "translated" to the API calls.
baltasarq wrote:The problem is that I'm not using the HTTP API, I have to refer myself to the Java SDK API, ...
You don't need to do much more than you already have done. You're using HTTP API actually, in spit not directly; That's what Dropbox SDKs are for (not only Java Dropbox SDK). 😉 Of course, you can manage the API calls directly, but you don't need to.
baltasarq wrote:... I don't understand how the possible HTTP messages should be "translated" to the API calls.
They should NOT!!! 😁 All Dropbox API calls themselves are HTTP requests. SDK just hides this and make developer life easier. That's it.
Hi Greg, many thanks for answering. I guess you're tired of answering (more or less) the same questions repeatedly.
> Dropbox is no longer offering the option for creating new long-lived access tokens. (...)
Sure I know, that's why my life is miserable. 😉
> Apps can still get long-term access by requesting "offline" access though, in which case the app receives a "refresh token" that can be used to retrieve new short-lived access tokens as needed, without further manual user intervention. (...)
Great. I've already got this token through a call to the HTTP API, though I thought it was called "access token".
> The official Dropbox Java SDK can actually handle the process for you automatically, as long as you supply the necessary credentials, e.g., as shown retrieved in the examples here.
The problem with all these examples is that they trigger an oauth2 web page authorization which must be answered by the user, something I don't want.
> There's a basic outline of processing this flow in this blog post which may serve as a useful example.
The matter is how to these HTTP API calls should be translated to method calls in the Java SDK, something that is not detailed anywhere for my particular case.> For Android apps using the official Dropbox Java SDK, you should use the updated authorization functionality, starting with the startOAuth2PKCE method.
Okay, then should I forget about tokens and use this PKCE method? Just to be sure.
Many thanks again.
-- BaltasarThanks for answering.
> You don't need to do much more than you already have done.
It's unfortunate it is not working, though.
> They should NOT!!! 😁 All Dropbox API calls themselves are HTTP requests. SDK just hides this and make developer life easier. That's it.
Sure. Let me rephrase my question. What objects of the SDK must I create and what methods should I called so the code works?
Thanks,
-- Baltasar
- Greg-DB
baltasarq Здравко is correct; the Dropbox SDKs, including the Dropbox Java SDK, themselves call the Dropbox HTTP API. You can certainly just use the Dropbox Java SDK though. The second half of my previous message contains links specific to the Dropbox Java SDK, so refer to those for information on how to use that.
Anyway, to be clear, "access tokens" and "refresh tokens" are different types of tokens, and are not interchangeable. Refresh tokens can be used to programmatically retrieve more access tokens.
In order to get a refresh token, it is necessary to authorize the app via the app authorization web page. This only needs to be done once per account though.
The Dropbox Java SDK implements the same functionality as documented for the HTTP API. You can use the SDK or the HTTP interface directly; either way is fine and that is up to you.
The PKCE flow is recommended for client-side applications, such as Android apps.
If you're implementing the authorization flow on Android, it is recommended that you use the startOAuth2PKCE functionality as shown in the example I linked. That functionality in the SDK will do most of the work for you.
> the Dropbox SDKs, including the Dropbox Java SDK, themselves call the Dropbox HTTP API. You can certainly just use the Dropbox Java SDK...
I know that, I was simply noting that this does not help me to know the sequence of which classes and methods to call.
> The PKCE flow is recommended for client-side applications, such as Android apps. If you're implementing the authorization flow on Android, it is recommended that you use the startOAuth2PKCE functionality as shown in the example I linked. That functionality in the SDK will do most of the work for you.
Maybe I'm missing something big, but the app (Kotlin, not Java, but all right, I guess I'd be able to translate), does not contain a call to startOAuth2PKCE() which I had been able to find.
I'will try and pick up from here with PKCE. I'd like to note, however, that for a such important change in the API there is scarce info and documentation (many times obsolete), to follow, at least for the type of app (off-line) that I intend to write.
Thanks,
-- Baltasar
- Greg-DB
baltasarq Thanks for the feedback!
The startOAuth2PKCE method is defined here. If you're not seeing that method in your installation, please make sure you're using a recent version of the SDK. The latest version is currently v5.4.5.
Also, the Android example here is written in Kotlin, e.g., see the DropboxOAuthUtil.kt file.
For reference the startOAuth2PKCE method does automatically request "offline" access, in order to get a refresh token.
> @baltasarq Thanks for the feedback!
I found the code in the internal/ folder.
> The startOAuth2PKCE method is defined here. If you're not seeing that method in your installation, please make sure you're using a recent version of the SDK. The latest version is currently v5.4.5.
Yep. But, I guess that this initial authorize is only needed once, right? Then I should be able to access with a single token...
Thanks,
-- Baltasar
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
