Migrating App Permissions & Access Tokens

Long-lived access tokens are now considered deprecated, but we don't currently have a plan to disable existing long-lived access tokens. (If that changes, we will of course announce that ahead of time.) That being the case, your users can continue using their existing long-lived access token(s).

And yes, you can test your code with short-lived access tokens while the actual users of your app still use the existing long-lived access token flow. To do so, keep your "Access token expiration" setting on "No expiration", but set 'token_access_type=online' on /oauth2/authorize in your development code to explicitly request a short-lived access token. If using the official Dropbox Java SDK on Android in particular, refer to this example code to see how to switch between these options.

You can refer to the 'token_access_type' field documentation for /oauth2/authorize and Android Auth documentation for the Dropbox Java SDK in particular, as well as this post for more information.

Also, you don't have to change your "Access token expiration" setting before September of next year unless you want to, so you can update your app and wait for most of your users to update to the new version. And for any users on the old version when the change occurs, they'll still receive an access token when processing the app authorization flow, but it will just be short-lived instead of long-lived.