We’re Still Here to Help (Even Over the Holidays!) - find out more here.
Forum Discussion
Solved
short lived access token is invalid seconds after login
Hello everyone,
a client of mine wanted to test the app that I made for them for the first time.
- They were able to accept that my app is going to access their files ✔︎
- they were redirec...
Thanks for the additional information. That's helpful. The extra portion you're seeing on the access token is a region suffix, which Dropbox will append in certain cases. The access token is still meant to be opaque, so the app should still just use the access token string as provided, including that suffix, if present.
However I see the issue is that the value isn't being decoded before use, so attempting to use the encoded "%3AEUR" version fails. If you use the decoded version ":EUR", the access token should still work.
How are you parsing the access token from the redirected URL? You should make sure to decode it as a URL parameter when doing so, like in the example included with our JavaScript SDK, which uses this method to parse and decode the parameters.
(Alternatively, the newer and now recommended method for client-side apps is to use the PKCE flow, such as shown in this example for our JavaScript SDK. In that flow, the access token isn't returned on the redirected URL itself anyway.)
Greg-DB
Dropbox Community Moderator
Dropbox Community ModeratorThanks for the additional information. That's helpful. The extra portion you're seeing on the access token is a region suffix, which Dropbox will append in certain cases. The access token is still meant to be opaque, so the app should still just use the access token string as provided, including that suffix, if present.
However I see the issue is that the value isn't being decoded before use, so attempting to use the encoded "%3AEUR" version fails. If you use the decoded version ":EUR", the access token should still work.
How are you parsing the access token from the redirected URL? You should make sure to decode it as a URL parameter when doing so, like in the example included with our JavaScript SDK, which uses this method to parse and decode the parameters.
(Alternatively, the newer and now recommended method for client-side apps is to use the PKCE flow, such as shown in this example for our JavaScript SDK. In that flow, the access token isn't returned on the redirected URL itself anyway.)
Thank you so much for the help. Everything works as expected now.
I remember that I saw the `parseQueryString` function in the example and I naively replaced it with a one liner 😬
If the budget allows it I will have another look at the pkce version.
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
