Dropbox API, I can't upload a file to Dropbox (err. 401 Unauthorized)

[Polas]

Please, help: I can't upload a file to Dropbox (err. 401 Unauthorized)

I am using Delphi XE3, Indy THttp component. Please, can you look at the header and body of the message being sent to see if there is an error?
I got AccessToken on
https://dropbox.github.io/dropbox-api-v2-explorer/#auth_token/from_oauth1 
I assume it's persistent and I don't need to retrieve it every time I access it

const
API_URL = 'https://content.dropboxapi.com/2/files/upload';
cFile = 'D:\my_file_path_on_pc\testfile.txt';
cook
wAccessToken : string;
Source: TFileStream;
IdHTTP: TIdHTTP;
Res, OpenSSLpath, wVal : string;
Ssl: TIdSSLIOHandlerSocketOpenSSL;
begin
wAccessToken := '_my_access_token_';
Source := TFileStream.Create(cFile, fmOpenRead);
...
...
IdHTTP.Request.CustomHeaders.Values['Authorization'] := 'Bearer ' + wAccessToken;
IdHTTP.Request.CustomHeaders.Values['Dropbox-API-Arg'] :=
'{ "autorename": false, "mode": "add", "mute": false, "path": "/CUZK/test.txt", "strict_conflict": false }';
IdHTTP.Request.CustomHeaders.Values['Content-Type'] := 'application/octet-stream';

Res := IdHTTP.Post(API_URL, Source);

[Здравко]

---

@Polas wrote:

...
I assume it's persistent and I don't need to retrieve it every time I access it

...

---

Hi @Polas,

That's the mistake of you. In spite some time ago was possible to receive long lived access token, it's not possible anymore. You can still use available long lived access token if you have one (in the way you are trying to), but new one cannot be issued; all new tokens are short lived with validity period 4 hours, at most. For long term access you need refresh token and "refreshing" the access token every time it expires you have long term access access 😉. You can take a look here how you may organize your applications work. Refresh token doesn't expire automatically and alive until explicit revoke from either the application itself or user using your application.

Hope this helps.

[Greg-DB · Accepted solution]

@Polas Здравко is correct; new Dropbox access tokens are not persistent. Dropbox is no longer offering the option for creating new long-lived access tokens. Dropbox is switching to only issuing short-lived access tokens (and optional refresh tokens) instead of long-lived access tokens. You can find more information on this migration here.

Apps can still get long-term access by requesting "offline" access though, in which case the app receives a "refresh token" that can be used to retrieve new short-lived access tokens as needed, without further manual user intervention. You can find more information in the OAuth Guide and authorization documentation. There's a basic outline of processing this flow in this blog post which may serve as a useful example.

And for debugging issues like this, you should print out the HTTPS response body, as it should contain a more useful error message (such as 'invalid_access_token' or 'expired_access_token'). You may need to refer to the documentation for your network client for information on how to access the response body.