Showing results for 
Show  only  | Search instead for 
Did you mean: 
Are you interested in hearing how one of our Community members uses Dropbox for sailing trips? Read all about it here.

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

short-lived token expired

short-lived token expired

Explorer | Level 4

I'm updating my code to use dropbox-core-sdk-3.1.5 instead of dropbox-core-sdk-3.1.1.
I've updated my app permission to use the short-lived access token in the Dropbox Console.

When a user login into my app, she can connect her dropbox account, and the dropbox content is downloaded and shown.
But after 4h, she must reconnect the dropbox account since token is expired.


How can I avoid this?


My calls are

// V2 api /oauth2/authorize
DbxWebAuth.Request authRequest = DbxWebAuth.newRequestBuilder()
.withRedirectUri(redirectUri, sessionStore)

DbxWebAuth webAuth = new DbxWebAuth(reqConfig, appInfo);




// V2 api /oauth2/token
DbxWebAuth webAuth = new DbxWebAuth(reqConfig, appInfo);

authFinish = webAuth.finishFromRedirect(
redirectUri, sessionStore, params);


And I use this authFinish to call the get the current account


// V2 api /2/users/get_current_account
DbxClientV2 dbxClient = new DbxClientV2(reqConfig, accessToken);
FullAccount fullAccount = dbxClient.users().getCurrentAccount();
return fullAccount;


Then I store the access token


AuthorizationToken token = new AuthorizationToken();


Should I use the refresh_token instead of the access token?

Should I check the expires time, and recall the /oauth2/token specifying grant_type=refresh_token ?

3 Replies 3

Dropbox Staff

Short-lived tokens are valid for four hours (note that this value is subject to change).


After a short lived token has expired, simply sending the user to re-auth and using the new token would be recommended for most web applications. The OAuth/redirect for an authorized app is typically automatic for an authorized app,  which is easy and low friction for end users.


If your application requires background access, then you should use refresh tokens. Refresh tokens do not expire, and will let your retrieve a new access token at any time - with SDKs automating this for you. Most web applications would not need refresh tokens; this is more commonly associated with mobile or server side apps.


In the Java SDK, you'll want to use this constructor to pass the refresh token in the DbxCredential argument.

Explorer | Level 4

yes, my app needs to interact with the Dropbox API without user input.

What do you mean with "SDKs automating this for you" ?

I'm using the sdk 3.1.5 calling /oauth2/authorize with TokenAccessType.OFFLINE.

Should I check DbxWebAuth .getExpiresAt() and if needed, I should require a new token using the refresh_token as explained here ?


thanks for you help


Dropbox Staff

If you request "offline" access like that, you'll get a refresh token that can be used to programmatically get a new short-lived access token whenever needed. If you use the constructor my colleague linked to, supplying your refresh token, app key, and app secret (if not using PKCE) in the DbxCredential, the Java SDK will automatically check the expiration and retrieve a new short-lived access token for you, so you that don't need to implement that yourself.

Need more support?
Who's talking

Top contributors to this post

  • User avatar
    Greg-DB Dropbox Staff
  • User avatar
    luigia Explorer | Level 4
  • User avatar
    kylea Dropbox Staff
What do Dropbox user levels mean?