Re: Uploading large files directly from web application.

For large files, i know it's not a good practice to expose the credentials, but...

1 - get the token from server-side

2 - use the token to upload from client-side and once the upload starts (or the first bytes are sent), send to server-side to refresh the token.

I guess that, once the upload process start, the token is no more necessary, so you can refresh it.

Also, using a second account (a free one) to just use as upload and move the file to a paid account as soon as the upload finish.

You can use the refresh process (that is, calling /oauth2/token with grant_type=refresh_token) to get a new short-lived access token using a refresh token at any time, but doing so does not invalidate previous short-lived access tokens.

You can use /2/auth/token/revoke to revoke an access token, but that will also revoke the corresponding refresh token and other short-lived access tokens for that refresh token, if any.

Dropbox also does not offer a guarantee on the timing as to when during the connection/API call the authorization check occurs, so I would not recommend relying on that.

Got it! Dropbox team should really think about implement that. As other people said here, don't make sense upload large files twice, spending time and bandwidth.

Thanks for the feedback! I'll send it along to the team.