cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Update: Find information on Dropbox support during COVID-19 here
Close

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Dropbox not sending refresh_token using new OAuth2 flow

Explorer | Level 4

Hi,

 

(Sorry I first posted this as a reply to this "solved" topic, which was a bad idea because it's mostly unrelated)

 

I'm developing a "native" app (called Ginj), and started Dropbox integration a few weeks ago.

I first used Dropbox's Java API for authorization, using PKCE and "copy/paste" from browser to app, and it seemed to work pretty well but now it seems I'm forced to re-authorize regularly.

After checking the received tokens, they are now indeed short-lived "sl-..." tokens, so I decided to call the REST OAuth API myself to see if I could implement the updated flow, and also get rid of the copy/paste step.

I think I'm nearly done, but when exchanging the received code for tokens, the response I'm getting contains an "access_token", but no "refresh_token" and no "expires_in". 

Now the access token seems to be "long lived" again, but I'm reading non-expiring tokens are getting deprecated, so I'd rather switch to the refresh logic while I'm at it...

How can I get a refresh_token ?

 

KR, 

Vicne

1 Accepted Solution

Accepted Solutions
Highlighted

Re: Dropbox not sending refresh_token using new OAuth2 flow

Dropboxer
Dropboxer

We recommend just using the official SDKs whenever possible, as they'll do most of the work for you, but you can certainly use the HTTPS endpoints directly if you'd like.

 

You can find information on this in the authorization documentation, as well as the new OAuth Guide.

 

Most apps currently default to long-lived access tokens, but if you want to start using short-lived access tokens, you should set the 'token_access_type' parameter on your /oauth2/authorize URL. You can find information on using that in the /oauth2/authorize documentation. Specifically, to get short-lived tokens with a refresh token, you should set it to "offline".

View solution in original post

2 Replies 2
Highlighted

Re: Dropbox not sending refresh_token using new OAuth2 flow

Dropboxer
Dropboxer

We recommend just using the official SDKs whenever possible, as they'll do most of the work for you, but you can certainly use the HTTPS endpoints directly if you'd like.

 

You can find information on this in the authorization documentation, as well as the new OAuth Guide.

 

Most apps currently default to long-lived access tokens, but if you want to start using short-lived access tokens, you should set the 'token_access_type' parameter on your /oauth2/authorize URL. You can find information on using that in the /oauth2/authorize documentation. Specifically, to get short-lived tokens with a refresh token, you should set it to "offline".

View solution in original post

Highlighted

Re: Dropbox not sending refresh_token using new OAuth2 flow

Explorer | Level 4

Yes, that was it.

Adding "token_access_type=offline" to the authorize url at the beginning of the transaction resulted in both a short-lived access token with a lifetime of 1440s (4h) and a refresh_token that I'll be able to use once the access_token is outdated.

 

Thanks for the great support.

 

Vicne

Polls
Do you know how to organize your files and folders?
We have created a guide on folder best practice, so you can get organized now check it out here.

Work Smarter with Dropbox

The way we work is changing. Share and discover new ways to work smarter with Dropbox in our community.

Sound good? Let's get started.
Who's talking

Top contributors to this post

What do Dropbox user levels mean?
Need more support?