We Want to Hear From You! What Do You Want to See on the Community? Tell us here!
Forum Discussion
OAuth 2.0 Access Token Validity
I have been trying to use the dropbox apis through OAuth 2.0 authentication support. I found that the access token generated through the authorize and token end points seems to be valid for over 2 days. I had expected it to expire after a while (say couple of hours) assuming that to be a standard.
I would like to know the validity period of the access token. Can someone share provide some inputs?
Thanks!
4 Replies
Replies have been turned off for this discussion
Steve M.Dropbox Staff
See https://www.dropbox.com/developers/support#token-expiration.
Access tokens effectively don't expire.
Isn't it a security issue if the token don't expire? http://stackoverflow.com/a/7035926/537503
- Steve M.
Because Dropbox does a database lookup for each request, our bearer tokens are immediately revocable by code or by the user (via https://www.dropbox.com/account/security). We reviewed our OAuth 2 implementation with respect to the issues raised in that Stack Overflow answer as well as many other sources, and we're comfortable with what we have from a security perspective.
:)
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
