cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Back again with another edition of 'How we use Dropbox', so find out how Emma uses to-do lists to get it all done here!

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Some questions about security

Some questions about security

Nickk888
Explorer | Level 3
Hello everyone!

I have some questions about the API security.

The application I am programming right now is connected to my dropbox account registered as an App that is using a different directory.

The problem is the token...
For now the token is in a string variable inside the code, because the app will be for other users on the internet, everyone who decompiles the application will get the token right?

So how can I make my app more secure? Could I set that the app can ONLY download and view the content? I don't want other users to mess with the files nor upload something using the token.

Other services are using credentials to make a secure connection and autentification, is it also somehow possible with the Dropbox app?

I'm writing in C# by the way.

Kind regards.
2 Replies 2

Re: Some questions about security

Greg-DB
Dropboxer

The API was designed with the intention that each user would link their own Dropbox account, in order to interact with their own files. It is technically possible to connect to just one account, by embedding an access token for the desired account in the app itself, like you describe, but we don't recommend doing so, for various technical and security reasons.

There isn't a way to configure a download-only permission, but I'll pass this along as a feature request. 

Alternatively, you could consider using shared links to link to content in your Dropbox:


https://www.dropbox.com/help/files-folders/view-only-access

You can modify these links for direct access, e.g., to programmatically download from them:


https://www.dropbox.com/help/desktop-web/force-download

Re: Some questions about security

Greg-DB
Dropboxer

I just wanted to follow up on this to let you know that we've released "scopes" functionality on the Dropbox API, which you can use to configure an app or access token to only a limited set of functionality, such as the ability to read but not write files.

 

You can find more information about the release in our blog post here:

 

https://dropbox.tech/developers/now-available--scoped-apps-and-enhanced-permissions  

Poll
We love to learn from the educators who use Dropbox. Whether you teach kids, teens, adults or a combination of all three, we want to know what apps and integrations you use with Dropbox to help with teaching. Which of the ones below is your favorite, or most used tool?
Who's talking

Top contributors to this post

  • User avatar
    Greg-DB Dropboxer
What do Dropbox user levels mean?
Need more support?