get access token from oauth1token and oauth1tokensecret

1. I see you're trying to call the /2/auth/token/from_oauth1 endpoint. It sounds like this is a new integration, so as Здравко noted, you should not be using that endpoint anyway. This endpoint is only meant for use if you already have pre-existing OAuth 1 access tokens. It should not be used as part of the OAuth 2 app authorization flow.
 
OAuth 1 access tokens were a feature of an old version of the Dropbox API. If you've only used API v2 and OAuth 2, you wouldn't have any OAuth 1 access tokens. If you don't have pre-existing OAuth 1 access tokens, for instance, if you're just developing the integration now, you should send the user through the normal OAuth 2 app authorization flow.
 
You can find information on how this works in the OAuth Guide and authorization documentation. 

2. The Dropbox API does have a rate limiting system that applies to all account types, but we don't have specific rate numbers documented for that, and we cannot increase the limits for any particular app, user, or team. Apps should be written to handle these rate limit responses automatically. Also note that not all responses with a 429 or 503 status code indicate explicit rate limiting, but in any case that you get a response with 429 or 503 status code the best practice is to retry the request, respecting the Retry-After header if given in the response, or using an exponential back-off, if not. I recommend referring to the error documentation and Error Handling Guide for more information. The Performance Guide may also be helpful.

Additionally, there is a specific limit for uploads to some Dropbox Business team plans of "1 billion API calls/month" for "data transport" noted here. This is a limit on the number of upload API calls that can be made per team per month, for certain Dropbox Business team plans only. Note that this only applies to upload calls, and not other types of calls. You can find more information on this limit in the developer documentation here.

If the Dropbox API needs to reject any call(s), it will respond with a relevant error message; it will not just ban your IP address.