GET /1/oauth/request_token return 400 error

blink For reference, your app should never be directly handling the user's username and password. The user should only ever put those in to the Dropbox web site, e.g., when logging in to the Dropbox web site during the OAuth app authorization flow to authorize the API app. This applies to both API v1 and API v2.

For API v2, which only supports OAuth 2, you should migrate to using OAuth 2 entirely, not OAuth 1. (If you have any remaining OAuth 1 access tokens you need to migrate to OAuth 2 for use with API v2, you should use /2/auth/token/from_oauth1 which is an API v2 endpoint and will continue to work.)

You can find the OAuth 2 documentation here:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

The Dropbox OAuth 2 implementation supports the "token" and "code" flows, which unfortunately don't work as well with the technique of emailing the authorization link to the user to have them authorize the app on another device. This is because the "token" flow requires a redirect URI, and the "code" flow, when used without a redirect URI, requires the user to manually transfer the authorization code somehow, as pcworld mentioned.

If that doesn't work for your app, e.g., if it doesn't have a browser at all, open an API ticket with details about your app and use case and we'll see if there's something we can do to help.