Authorisation flow for a Python client console app

[aplowman]

I am trying to integrate Dropbox into my Python console application. I understand there are two types of authorisation flows: "code" and "token". Since my app is a client app, I don't want to have to store an app secret within the source code and so I believed the "token" flow was the right choice for me. So I started a simple local server up from within my app that can serve on a URI that I have added to my "Redirect URIs" on the Dropbox App console. The problem is: the access token forwarded by Dropbox after authorisation is stored in the URL fragment that is not sent to the server (as opposed to in the query string), so there is no way for my Python console app to access the token. How can I authorise Dropbox in this case without exposing an app secret? Thanks.

[Greg-DB]

That's correct, using the "token" flow is preferred for client-side applications like this, as it doesn't require the use of the app secret.

As you mentioned though, the access token is returned on the URL fragment of the required redirect URI, so it's not acessible to the server. So, to get the access token back to a console app, you'll need to retrieve the access token via another means. Some options are:

• display the access token on your redirect URI page, and have the user manually copy and paste it into the app 
• run some JavaScript on your redirect URI page to get the access token from the fragment and send it to your app via a mechanism of your choosing (e.g., some other HTTPS/AJAX request)

[aplowman]

Thanks for your reply. I'll try out these solutions!

This is a tricky situation for my app, since it will be mainly used on a remote cluster, where users connect via SSH and there is no desktop environment. I'm guessing there are no ways to authorise wholly in the command line?

[Greg-DB · Accepted solution]

No, the Dropbox API only supports the "token" and "code" OAuth 2 flows, both of which require user interaction in the browser. 

So in your case, given the interaction is with a remote machine, it sounds like having the user copy/paste the token may be the most reasonable option. You can use this page as your redirect URI for that if you want: https://www.dropbox.com/1/oauth2/display_token