API method to download file within shared folder, no token required

[mgbelisle]

Hello Dropbox team,

I've been reading through the HTTP API documentation trying for figure out how to do the following, without success. Given a folder foo that has been publicly shared, I want to programatically download a file within it, let's say foo/bar/baz.txt Here is an example folder

https://www.dropbox.com/sh/p0fa8tl8zzmetuv/AABKUyvlxZGIOvxPWPoothbra?dl=0

The id of that foo folder is id:kLMXpr_BUfIAAAAAAAQJqg so in order to download foo/bar/baz.txt with a token you can clearly do this:

$ curl -X POST https://content.dropboxapi.com/2/files/download -H  "Authorization: Bearer $TOKEN" -H "Content-Type: text/plain" -H 'Dropbox-API-Arg: {"path": "id:kLMXpr_BUfIAAAAAAAQJqg/bar/baz.txt"}'
hello world

But that requires a token, and the folder is public so no token should really be needed. I see the /2/sharing/get_shared_link_file endpoint too, but it also requires a token. I also see that you can download  https://www.dropbox.com/sh/p0fa8tl8zzmetuv/AABd6WxiqSLVgQkrNzSP2B54a/bar/baz.txt?raw=1 directly but there is no way (that I see) to programatically know that AABd6WxiqSLVgQkrNzSP2B54a segment given just the url of the foo folder or the id of the foo folder.

Is there any way to programatically download foo/bar/baz.txt without a token? Let me know if you need more details.

Thanks in advance,
Matt

[Greg-DB · Accepted solution]

Unfortunately, there isn't a good solution for this use case. Those endpoints are the right ways to download using a file path/ID or shared link, respectively, but as you found both of those only support "user authentication", so an access token is necessary. I'll pass this along as a feature request for support for calling without an access token, but I can't promise if or when that might be implemented. 

Another option would be to download from the shared link itself using the parameters documented here like you said, but that doesn't offer a way to specify and get only a particular file from the linked folder, as you found.

[mgbelisle]

Roger that, thanks for the info Greg. I'll probably just throw a low scoped burner token for a throwaway account hard coded into my app and hope no one decompiles it to abuse it. Hopefully it won't hit those rate limits because the nature of my files is that they can be cached forever thankfully.

If that feature is ever added just let me know and I'll consume it.

Regards,

Matt