PKCE vs Tokenbearer in LUA

Dropbox doesn't have any official resources for Lua in particular, but perhaps someone else on the forum has something they can share.

As for the functionality itself, note that every Dropbox user API access token identifies one specific app-account pair, and allows access to that account to the extent allowed by the app's permissions as authorized by the user. So, the access token you generated on the App Console is for that app and your account in particular. In order to allow arbitrary end-users to connect the app to their own accounts, you should implement the OAuth flow in your app. That way, the app gets an access token for each end-user. You can find more information in the OAuth Guide and authorization documentation. For client-side apps, the PKCE OAuth flow in particular is the best option.

You should not embed and distribute your own access token (or refresh token) in a client-side app, as that would enable anyone with the app to get the access token and use it to access your own account. Even if you attempt to obfuscate the token(s) in the app's binary, client-side apps can't keep secrets secure, so you could only make it more difficult but not impossible for someone to extract the token(s).