Forum Discussion

Andreas D.8's avatar
Andreas D.8
New member | Level 1
11 years ago

How to make sure clients dont misuse access tokens provided to them?

I want to develop a Dropbox Desktop app that would retrieve an access token via a web service (which in turn would perform OAuth2 authentication and then give the user a magic key that he can enter i...
API
Richard P.'s avatar
Richard P.
Icon for Super User alumni rankSuper User alumni
11 years ago

Run your own web service and tunnel all Dropbox access via that. Other than that, if both the application token and the client token is available to me locally, there's absolutely nothing you can do to stop me extracting and using them. You have already put them in an environment you cannot control, so there is nothing you can do to ultimately secure them from a determined attacker.

About Dropbox API Support & Feedback

Node avatar for Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.

The Dropbox Community team is active from Monday to Friday. We try to respond to you as soon as we can, usually within 2 hours.

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X, Facebook or Instagram.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!