Announcements
Known issues updated. Learn more

Authorisation flow for a Python client console app

Level 4

I am trying to integrate Dropbox into my Python console application. I understand there are two types of authorisation flows: "code" and "token". Since my app is a client app, I don't want to have to store an app secret within the source code and so I believed the "token" flow was the right choice for me. So I started a simple local server up from within my app that can serve on a URI that I have added to my "Redirect URIs" on the Dropbox App console. The problem is: the access token forwarded by Dropbox after authorisation is stored in the URL fragment that is not sent to the server (as opposed to in the query string), so there is no way for my Python console app to access the token. How can I authorise Dropbox in this case without exposing an app secret? Thanks.

1 Accepted solution

Accepted Solutions
Highlighted

Re: Authorisation flow for a Python client console app

Dropboxer

No, the Dropbox API only supports the "token" and "code" OAuth 2 flows, both of which require user interaction in the browser. 

So in your case, given the interaction is with a remote machine, it sounds like having the user copy/paste the token may be the most reasonable option. You can use this page as your redirect URI for that if you want: https://www.dropbox.com/1/oauth2/display_token

Reply
Loading...
3 Replies

Re: Authorisation flow for a Python client console app

Dropboxer

That's correct, using the "token" flow is preferred for client-side applications like this, as it doesn't require the use of the app secret.

As you mentioned though, the access token is returned on the URL fragment of the required redirect URI, so it's not acessible to the server. So, to get the access token back to a console app, you'll need to retrieve the access token via another means. Some options are:

  • display the access token on your redirect URI page, and have the user manually copy and paste it into the app 
  • run some JavaScript on your redirect URI page to get the access token from the fragment and send it to your app via a mechanism of your choosing (e.g., some other HTTPS/AJAX request)
Reply
Loading...

Re: Authorisation flow for a Python client console app

Level 4

Thanks for your reply. I'll try out these solutions!

This is a tricky situation for my app, since it will be mainly used on a remote cluster, where users connect via SSH and there is no desktop environment. I'm guessing there are no ways to authorise wholly in the command line?

Reply
Loading...
Highlighted

Re: Authorisation flow for a Python client console app

Dropboxer

No, the Dropbox API only supports the "token" and "code" OAuth 2 flows, both of which require user interaction in the browser. 

So in your case, given the interaction is with a remote machine, it sounds like having the user copy/paste the token may be the most reasonable option. You can use this page as your redirect URI for that if you want: https://www.dropbox.com/1/oauth2/display_token

Reply
Loading...
API Support

Have a question? Our Dropbox Community is here to help you find an answer!
You won’t have to wait too long for a reply, but why not learn more about the Community while you’re here.

Not the right discussion for you? Find out what else our Community has to say about API Support.

Or, search our Help Center for even more.