Auth Token Question

No, the Dropbox API doesn't automatically expiring tokens, but I'll be sure to pass this along as a feature request. You can revoke any token on demand though, using authTokenRevoke.

 

Also, note that the API was designed with the intention that each user would link their own Dropbox account, in order to interact with their own files. However, it is technically possible to connect to just one account. We don't recommend doing so, for various technical and security reasons, such as what you mentioned.

So it sounds like I will need to do this server side like PHP or Java to hide the token, etc?

 

Thanks

Yes, that would be the only safe way to do it.