Secure file downloads without a dropbox account

[Chase Denecke]

I'm currently building an app for users to get access to confidential data.

I like users authorized through our portal to be able to download files from our business dropbox account without the need to create a dropbox account.

Ideally they'd be granted some token through the portal that allows them to access a particular set of files or a particular folder, and when they click a button in our portal the files would be downloaded to their browser.

Is this possible? All the guides I've read imply the only way to do this is if the user has a dropbox account. Is it possible to do this without one?

[Greg-DB · Accepted solution]

The Dropbox API is generally meant for users to connect to their own accounts, but Dropbox itself does offer sharing functionality that can be used to share content to users who don't have their own Dropbox accounts. In particular, shared links can be useful for that. You can also modify these links for different behaviors, such as direct downloads.

You can use the Dropbox API to create and list shared links programmatically, via /2/sharing/create_shared_link_with_settings and /2/sharing/list_shared_links, respectively. As long as you don't leak your access token to other users, i.e., make sure you only keep the access token server-side, you could use make those calls to get shared links as needed and pass those shared links to your end-users. (For reference, the /2/files/get_temporary_link functionality is similar and doesn't rely on actual shared links; it just makes a temporary link that's only valid for four hours. It only works for individual files though, not folders.)