<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic OAuth 2.0 for native apps in Dropbox API Support &amp; Feedback</title>
    <link>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335052#M19545</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;How a native app (a desktop application) can implement and use the Authorization flow without having to know/use the app's secret?&lt;/P&gt;&lt;P&gt;Quoting from &lt;A href="https://www.oauth.com/oauth2-servers/oauth-native-apps/" target="_blank" rel="noopener"&gt;here:&lt;/A&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;"The current industry best practice is to use the Authorization Flow while omitting the client secret, and to use an external user agent to complete the flow."&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;The browser of the system can be this "&lt;EM&gt;external user agent&lt;/EM&gt;", but all the examples that I could find for the Java SDK (as &lt;A href="https://github.com/dropbox/dropbox-sdk-java/blob/master/examples/authorize/src/main/java/com/dropbox/core/examples/authorize/Main.java" target="_blank" rel="noopener"&gt;this&lt;/A&gt; one) need the app-info file with the secret populated in order to work. I have tried having the secret empty or null but the authorization fails at the end with the following error:&lt;/P&gt;&lt;PRE&gt;Error in DbxWebAuth.authorize: {"error": "invalid_client: Invalid client_id or client_secret"}&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is implicit grant the only way to go?&lt;/P&gt;</description>
    <pubDate>Wed, 29 May 2019 09:07:17 GMT</pubDate>
    <dc:creator>aston</dc:creator>
    <dc:date>2019-05-29T09:07:17Z</dc:date>
    <item>
      <title>OAuth 2.0 for native apps</title>
      <link>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335052#M19545</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;How a native app (a desktop application) can implement and use the Authorization flow without having to know/use the app's secret?&lt;/P&gt;&lt;P&gt;Quoting from &lt;A href="https://www.oauth.com/oauth2-servers/oauth-native-apps/" target="_blank" rel="noopener"&gt;here:&lt;/A&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;"The current industry best practice is to use the Authorization Flow while omitting the client secret, and to use an external user agent to complete the flow."&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;The browser of the system can be this "&lt;EM&gt;external user agent&lt;/EM&gt;", but all the examples that I could find for the Java SDK (as &lt;A href="https://github.com/dropbox/dropbox-sdk-java/blob/master/examples/authorize/src/main/java/com/dropbox/core/examples/authorize/Main.java" target="_blank" rel="noopener"&gt;this&lt;/A&gt; one) need the app-info file with the secret populated in order to work. I have tried having the secret empty or null but the authorization fails at the end with the following error:&lt;/P&gt;&lt;PRE&gt;Error in DbxWebAuth.authorize: {"error": "invalid_client: Invalid client_id or client_secret"}&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is implicit grant the only way to go?&lt;/P&gt;</description>
      <pubDate>Wed, 29 May 2019 09:07:17 GMT</pubDate>
      <guid>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335052#M19545</guid>
      <dc:creator>aston</dc:creator>
      <dc:date>2019-05-29T09:07:17Z</dc:date>
    </item>
    <item>
      <title>Re: OAuth 2.0 for native apps</title>
      <link>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335102#M19547</link>
      <description>&lt;P&gt;Yes, for client-side apps, you should use the "implicit" a.k.a. "token" flow. This is the version of the&amp;nbsp;Dropbox OAuth app authorization flow that does not require use of the app secret.&lt;/P&gt;
&lt;P&gt;The&amp;nbsp;&lt;A href="https://dropbox.github.io/dropbox-sdk-java/api-docs/v3.0.x/com/dropbox/core/DbxWebAuth.html" target="_self"&gt;DbxWebAuth class&lt;/A&gt; in the&amp;nbsp;&lt;A href="https://github.com/dropbox/dropbox-sdk-java" target="_self"&gt;official&amp;nbsp;Dropbox API v2 Java SDK&lt;/A&gt;&amp;nbsp;is only built for web apps though, and does not support the implicit flow.&amp;nbsp;I'll pass this along as a feature request, but I can't promise if or when that might be implemented though.&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;There is&amp;nbsp;&lt;/SPAN&gt;&lt;A href="https://github.com/dropbox/dropbox-sdk-java/blob/master/examples/android/src/main/java/com/dropbox/core/examples/android/UserActivity.java#L35" target="_self" rel="nofollow noreferrer"&gt;a special flow built for Android&lt;/A&gt;&lt;SPAN&gt;&amp;nbsp;though, in case you're running on Android. Otherwise, you'll need to implement &lt;A href="https://www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize" target="_self"&gt;the implicit flow&lt;/A&gt; directly.&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 21 Mar 2019 15:29:48 GMT</pubDate>
      <guid>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335102#M19547</guid>
      <dc:creator>Greg-DB</dc:creator>
      <dc:date>2019-03-21T15:29:48Z</dc:date>
    </item>
    <item>
      <title>Re: OAuth 2.0 for native apps</title>
      <link>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335256#M19553</link>
      <description>&lt;P&gt;Thank you for the response.&lt;/P&gt;&lt;P&gt;I asked the &lt;A href="https://github.com/dropbox/dropbox-sdk-java/issues/243" target="_blank" rel="noopener"&gt;question&lt;/A&gt; for implementation plans in the Java SDK GitHub repo.&lt;/P&gt;</description>
      <pubDate>Fri, 22 Mar 2019 07:46:15 GMT</pubDate>
      <guid>https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/OAuth-2-0-for-native-apps/m-p/335256#M19553</guid>
      <dc:creator>aston</dc:creator>
      <dc:date>2019-03-22T07:46:15Z</dc:date>
    </item>
  </channel>
</rss>

