Logging to API (for folder/file listing/downloading) with least number of credentials?

I'm not sure I understand your question. Can you clarify what you mean by "the smallest number of user's dbx login info"?

Dropbox API apps should send users through an OAuth flow to authorize the app to access their account (or not) and receive an access token back. The API app itself should never handle the user's Dropbox actual credentials.

Grek K. - but how he chooses the app? That means he needs to enter app name? his login data (mail and password)? I need the option where he will enter at the most two of those.

And also, is there a way to list all dropbox files without using Dropbox apps?

Thanks for elaborating. The end users of your app don't need to enter any app name or anything to identify your app. When a user uses your app, e.g., by browsing to your app's web site, your app has its own app key already, and directs the user through an OAuth flow. This sends them to Dropbox to authorize your app. At that point, they will log in to Dropbox, if they aren't already logged in, however they normally login, e.g., using their username and password. The user is then sent back to your app. This way, your app never needs to handle user credentials. You can find more information on how this works in the OAuth guide here:

https://www.dropbox.com/developers/reference/oauthguide

We recommend using one of the official SDKs, if possible, as they'll do most of the work for you:

https://www.dropbox.com/developers/core

Once a user is linked to your app, you can use the /delta endpoint to get the full list of files and folders in the user's Dropbox account:

https://www.dropbox.com/developers/core/docs#delta
https://blogs.dropbox.com/developers/2013/12/efficiently-enumerating-dropbox-with-delta/

Greg thanks for thoroughness. That also helped a lot, but I wanted to know (It was my mistake if I forgot to emphasize that :/) the whole last question but regarding "Every user on my website logs in to his own dropbox folder" and not on one "static/fixed" Dropbox (eg. mine). So what would be the least he needs to type in to login to his app through my website, and to retrieve his folder. (yes I am using PHP SDK, but I'm kinda new..botj in PHP and APIs )

That is the normal scenario, that is, every user goes through the OAuth flow to authorize the app to connect to their own Dropbox account (and not just one static/fixed account).

I recommend trying out the web-file-browser sample app included with the PHP SDK to see how the flow works. It will look the same for each user, but each user will log into their own Dropbox account.