Forum Discussion

luigia's avatar
luigia
Explorer | Level 4
5 years ago

short-lived token expired

I'm updating my code to use dropbox-core-sdk-3.1.5 instead of dropbox-core-sdk-3.1.1. I've updated my app permission to use the short-lived access token in the Dropbox Console. When a user login i...
API
kylea's avatar
kylea
Icon for Dropbox Staff rankDropbox Staff
5 years ago

Short-lived tokens are valid for four hours (note that this value is subject to change).

 

After a short lived token has expired, simply sending the user to re-auth and using the new token would be recommended for most web applications. The OAuth/redirect for an authorized app is typically automatic for an authorized app,  which is easy and low friction for end users.

 

If your application requires background access, then you should use refresh tokens. Refresh tokens do not expire, and will let your retrieve a new access token at any time - with SDKs automating this for you. Most web applications would not need refresh tokens; this is more commonly associated with mobile or server side apps.

 

In the Java SDK, you'll want to use this constructor to pass the refresh token in the DbxCredential argument.

  • luigia's avatar
    luigia
    Explorer | Level 4
    5 years ago

    yes, my app needs to interact with the Dropbox API without user input.

    What do you mean with "SDKs automating this for you" ?

    I'm using the sdk 3.1.5 calling /oauth2/authorize with TokenAccessType.OFFLINE.

    Should I check DbxWebAuth .getExpiresAt() and if needed, I should require a new token using the refresh_token as explained here ?

    https://dropbox.tech/developers/migrating-app-permissions-and-access-tokens#updating-access-token-type

     

    thanks for you help

     

    • Greg-DB's avatar
      Greg-DB
      Icon for Dropbox Community Moderator rankDropbox Community Moderator
      5 years ago

      If you request "offline" access like that, you'll get a refresh token that can be used to programmatically get a new short-lived access token whenever needed. If you use the constructor my colleague linked to, supplying your refresh token, app key, and app secret (if not using PKCE) in the DbxCredential, the Java SDK will automatically check the expiration and retrieve a new short-lived access token for you, so you that don't need to implement that yourself.

About Dropbox API Support & Feedback

Node avatar for Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.

The Dropbox Community team is active from Monday to Friday. We try to respond to you as soon as we can, usually within 2 hours.

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X, Facebook or Instagram.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!