Need to see if your shared folder is taking up space on your dropbox 👨‍💻? Find out how to check here.

Forum Discussion

D658's avatar
D658
Explorer | Level 3
7 years ago
Solved

Will there be an "&&" in Token string?


Hi, there.

I am building a http connection with Dropbox, and I am using "post" to post data to https://content.dropboxapi.com

For now, my code is working.

1):But I want to ask, if there is any & character in Token string?
Because I am also using simple methods "post" and "get" to store and read Token in/from the database.
"post" and "get" methods are using & character too.

2): In the "create app" page, if I click twice the button "Generate", will the first generated token be invalid?
Can I use the two Token at the same time?

3): Is the Token the only thing I need, to access my own account?
I don't understand the work flow of https.
Should I download or provide any CA certification when the https connection (before sending the Token to dropbox server) is initialized?
Or after some uploads, will there be more auth or verification?

My code is something like this, for now, it is working.

POST /2/files/upload
Host: https://content.dropboxapi.com
User-Agent: api-explorer-client
Authorization: Bearer myToken
Content-Type: application/octet-stream
Dropbox-API-Arg: {"path":"/Apps/myAPP88289/a.jpg","mode":{".tag":"add"},"autorename":true,"mute":true,"strict_conflict":true}
Content-Length: 571313

--- (content of 2018-09-18_230651_393.jpg goes here) ---

Thank you very much..

  • 1) We don't have a documented guarantee of the exact format of Dropbox OAuth 2 access tokens, but the current implementation does not use "&". 

    2) You can create and use multiple access tokens for the same app-user pair. Clicking "Generate" a second time will not invalidate the first access token.

    3) An access token is all that is required to access an account, to the extent allowed by the corresponding app's permission level. You do not need to provide any additional information or certificate. Note that all Dropbox API calls do require TLS (i.e., as you can see from the https:// in your call, for instance), but that is all generally handled automatically for you.

    Dropbox API OAuth 2 access tokens currently don't expire automatically, though they can be revoked.

    Users can manually revoke tokens themselves, e.g. via:

    https://www.dropbox.com/account/connected_apps

    Apps can also revoke access tokens via:

    https://www.dropbox.com/developers/documentation/http/documentation#auth-token-revoke

    This being the case, you only need to process the authorization once, and save the access token for all future calls for that user. If an existing access token is invalid, (in which cases calls will return 401) you should prompt the user to re-authorize your app.

2 Replies

Replies have been turned off for this discussion
  • Greg-DB's avatar
    Greg-DB
    Icon for Dropbox Community Moderator rankDropbox Community Moderator
    7 years ago

    1) We don't have a documented guarantee of the exact format of Dropbox OAuth 2 access tokens, but the current implementation does not use "&". 

    2) You can create and use multiple access tokens for the same app-user pair. Clicking "Generate" a second time will not invalidate the first access token.

    3) An access token is all that is required to access an account, to the extent allowed by the corresponding app's permission level. You do not need to provide any additional information or certificate. Note that all Dropbox API calls do require TLS (i.e., as you can see from the https:// in your call, for instance), but that is all generally handled automatically for you.

    Dropbox API OAuth 2 access tokens currently don't expire automatically, though they can be revoked.

    Users can manually revoke tokens themselves, e.g. via:

    https://www.dropbox.com/account/connected_apps

    Apps can also revoke access tokens via:

    https://www.dropbox.com/developers/documentation/http/documentation#auth-token-revoke

    This being the case, you only need to process the authorization once, and save the access token for all future calls for that user. If an existing access token is invalid, (in which cases calls will return 401) you should prompt the user to re-authorize your app.

  • D658's avatar
    D658
    Explorer | Level 3
    7 years ago

    You saved me. Thank you very much.

About Discuss Dropbox Developer & API

Node avatar for Discuss Dropbox Developer & API
Make connections with other developers

The Dropbox Community team is active from Monday to Friday. We try to respond to you as soon as we can, usually within 2 hours.

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X, Facebook or Instagram.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!