We are aware of the issue with the badge emails resending to everyone, we apologise for the inconvenience - learn more here.
Forum Discussion
Oauth2 code short lived- how to implement correctly from B2B?
I am rewriting the old authorization code of my Windows service that communicates with Dropbox on behalf of a single, fixed user account. I have hit a snag. Usually I use the client credentials grant...
The updated Dropbox app authorization flow does now use short-lived access tokens and refresh tokens. In either implementation, the initial authorization does require some manual user interaction.
With the new functionality, if you need long-term access (that is, longer than four hours) without further manual interaction after the initial authorization, you should request "offline" access. That way, during the initial authorization your app will receive both a short-lived access token as well as a refresh token.
Then, when the current short-lived access token has expired, the app should use the refresh token to request a new short-lived access token, by calling /oauth2/token with 'grant_type=refresh_token'. This step can be done entirely programmatically, without additional manual user interaction.
You can find more information in the following resources:
Greg-DB
Dropbox Staff
Dropbox StaffThe updated Dropbox app authorization flow does now use short-lived access tokens and refresh tokens. In either implementation, the initial authorization does require some manual user interaction.
With the new functionality, if you need long-term access (that is, longer than four hours) without further manual interaction after the initial authorization, you should request "offline" access. That way, during the initial authorization your app will receive both a short-lived access token as well as a refresh token.
Then, when the current short-lived access token has expired, the app should use the refresh token to request a new short-lived access token, by calling /oauth2/token with 'grant_type=refresh_token'. This step can be done entirely programmatically, without additional manual user interaction.
You can find more information in the following resources:
That is what I did. However usually the refresh token is also short lived. You are saying I should persist the refresh token and use it even if my service restarts, to fetch a new auth token?
- Greg-DB
Yes, you should store and re-use the refresh token repeatedly. (Dropbox refresh tokens are not short-lived; they do not expire by themselves, though they can be revoked on demand by the user or app.)
Seems like I spoke too soon. It worked for a week or two but now the refresh token expired and I had to do the manual get token, then get refresh token, add to my code, restart the service routing which is just not cool.
I got HTTP Status code Unauthorized back after the refresh token worked fine for a while.
- Greg-DB
Dropbox OAuth 2 refresh tokens don't expire by themselves, but there are a number of ways they can become invalid. For example:
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
