Secure file downloads without a dropbox account

The Dropbox API is generally meant for users to connect to their own accounts, but Dropbox itself does offer sharing functionality that can be used to share content to users who don't have their own Dropbox accounts. In particular, shared links can be useful for that. You can also modify these links for different behaviors, such as direct downloads.

You can use the Dropbox API to create and list shared links programmatically, via /2/sharing/create_shared_link_with_settings and /2/sharing/list_shared_links, respectively. As long as you don't leak your access token to other users, i.e., make sure you only keep the access token server-side, you could use make those calls to get shared links as needed and pass those shared links to your end-users. (For reference, the /2/files/get_temporary_link functionality is similar and doesn't rely on actual shared links; it just makes a temporary link that's only valid for four hours. It only works for individual files though, not folders.)