nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

Distinction between Oauth 2 and PHP Core API (PHP SDK)

Priya M.

Hi,

I'm from Softaculous Ltd and we are now starting to integrate with Dropbox for Backups upload and download.

I want to know the difference between your PHP Core API or PHP SDK and OAUTH 2.

Also, do you have something as FTP stream to upload a tar.gz file in parts?

Find more posts tagged with

API

Abuse

Accepted answers

Greg-DB

If you want to use the HTTPS endpoints directly, that's possible using just curl.

Here are some basic examples using curl in PHP:

https://stackoverflow.com/documentation/dropbox-api/409/uploading-a-file/1354/uploading-a-file-via-curl-in-php#t=201702211923322665017

https://stackoverflow.com/documentation/dropbox-api/410/getting-account-information/1364/getting-space-usage-information-for-the-linked-user-via-curl-in-php#t=201702211923328624075

https://stackoverflow.com/documentation/dropbox-api/412/listing-a-folder/1370/listing-the-root-folder-via-curl-in-php-and-the-curl-extension#t=20170221192336214657

https://stackoverflow.com/documentation/dropbox-api/408/downloading-a-file/20965/downloading-a-file-with-metadata-via-curl-in-php#t=201702211923411507977

https://stackoverflow.com/documentation/dropbox-api/414/getting-a-shared-link-for-a-file-or-folder/24125/creating-a-shared-link-for-a-file-using-curl-in-php#t=201702211923392625782

To get an access token for the end user's account, you need to implement the OAuth app authorization flow. You can find information on how that works here:

https://www.dropbox.com/developers/reference/oauth-guide

The documentation for those endpoints can be found here:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

All comments

Greg-DB

The PHP Core SDK is a PHP SDK for accessing Dropbox API v1, a.k.a. the Dropbox Core API. API v1 is deprecated though, so you should no longer use that.

You should use API v2 instead. We don't have an official PHP SDK for API v2, so you can either use a third party library or call the HTTPS endpoints directly.

OAuth is an authorization protocol, used by the Dropbox API. API v1 supports OAuth 1 and OAuth 2. API v2 supports OAuth 2.

Priya M.

Hi Greg,

If I make use of HTTPS endpoints directly to use API v2, do I have to include some Dropbox classes or direct curl call will work?

Also, I'm not able to understand how to use these endpoint URLs using PHP. Can you please give me an example?

I want to generate the auth token of the user's account, how can I do so and using which endpoint?

Greg-DB

Priya M.

Hi,

Thank you for your reply.

I'm not able to understand how to make the PHP curl call, what all curl parameters are to be set, etc. I'm not able to understand how to fetch the user auth token using the authorization API:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

I'm using it like this. Please correct me:

$post['response_type'] = 'token';
$post['client_id'] = '6i45k3fi9a1i9an';
$post['redirect_uri'] = get_current_url().'&auth_callback=1';
$url = 'https://www.dropbox.com/oauth2/authorize';
// Set the curl parameters.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
//Set proxy 
//curl_proxy($ch);
// Turn off the server and peer verification (TrustManager Concept).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));

curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_NOBODY, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1');

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Get response from the server.
$resp = curl_exec($ch); 
r_print($resp);

Priya M.

Hi,

I made the following changes:

function get_current_url() {
$url = @($_SERVER["HTTPS"] != 'on') ? 'http://'.$_SERVER["SERVER_NAME"] : 'https://'.$_SERVER["SERVER_NAME"];
$url .= ($_SERVER["SERVER_PORT"] != 80) ? ":".$_SERVER["SERVER_PORT"] : "";
$url .= $_SERVER["REQUEST_URI"];
return $url;
}
$url = 'https://www.dropbox.com/oauth2/authorize?response_type=token&client_id=6i45k3fi9a1i9an&redirect_uri='.get_current_url();
// Set the curl parameters.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
// Turn off the server and peer verification (TrustManager Concept).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); 

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Get response from the server.
$resp = curl_exec($ch);
echo '<br />Curl Error: '.curl_error($ch);
echo '<br />Curl Response: ';
r_print($resp);

Using this I get:

Invalid redirect_uri: "https://cpanel.nuftp.com:2083/cpsess5895978520/frontend/paper_lantern/softaculous/index.live.php": It must exactly match one of the redirect URIs you've pre-configured for your app (including the path).

How do I specify the redirect URL?

Also, I want to redirect this auth process in a separate window, which when accepted by the user should return back to the current window. How do I do that?

Greg-DB

You're attempting to access /authorize by submitting an HTTP request to it via curl like you would for an API call, but /authorize is actually a web page the user should interact with in their browser, and not an API endpoint.

You should construct the /authorize URL and then direct the user there in their browser. (Exactly how you do that will depend on your setup, e.g., your web framework.)

The redirect_uri value should be the URL of the page where you want the user sent back to after they authorize your app. As a security measure, it needs to exactly match a redirect URI registered for your app via your app's page on the App Console. If it doesn't you'll get that error you posted.

Priya M.

Hi,

>>The redirect_uri value should be the URL of the page where you want the user sent back to after they authorize your app. As a security measure, it needs to exactly match a redirect URI registered for your app via your app's page on the App Console. If it doesn't you'll get that error you posted.
The Redirect URI in our case may vary as we provide user the utility to authorize to our Dropbox APP from various pages. We probably cannot set all those URIs in the APP settings via our APP's page. How to handle this?

Greg-DB

I'm afraid I don't have a great solution for you, as OAuth 2 redirect URIs for the Dropbox API are required to be pre-registered exactly. I'll be sure to pass this along as feedback though.

One thing you may be able to do instead is to use one static redirect URI but encode the necessary information in the 'state' parameter, and decode it as necessary after the redirect back to your app, to handle it as necessary:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

Alternatively, you could forgo using a redirect URI entirely. With the "code" flow, you can omit redirect_uri and have the user copy and paste the code manually. (Or, for the "token" flow, you can use https://www.dropbox.com/1/oauth2/display_token as the redirect URI and have the user copy and paste the access token.)

Priya M.

Hi,

Can you please tell me some examples of usage of this API? How will I fetch the access token when the authorization is successfull and the user is redirected back to the uri as specified in tge redirect uri?

Also, when I'm using this API, I'm getting the error of 'invalid response type code'.

Greg-DB

For the API calls itself, please refer to the samples I linked to earlier in this thread.

For the OAuth app authorization flow, you may want to see how the PHP Core SDK did it, as the OAuth 2 app authorization flow is the same for API v1 and v2:

https://github.com/dropbox/dropbox-sdk-php/blob/master/examples/web-file-browser.php#L21
https://github.com/dropbox/dropbox-sdk-php/blob/master/lib/Dropbox/WebAuth.php#L192

If you're running in to any particular issues, feel free to post the relevant code and full output.

Priya M.

Hi,

Thank you for your response.

In the documentation here:

http://dropbox.github.io/dropbox-sdk-php/api-docs/v1.1.x/class-Dropbox.WebAuth.html

in the code here:

$appInfo = dbx\AppInfo::loadFromJsonFile(...);

what should be mentioned as parameters in loadFromJsonFile(...)?

Also, I'm using the following code to fetch the user's ccess token:

function get_current_url() {
$url = @($_SERVER["HTTPS"] != 'on') ? 'http://'.$_SERVER["SERVER_NAME"] : 'https://'.$_SERVER["SERVER_NAME"];
$url .= ($_SERVER["SERVER_PORT"] != 80) ? ":".$_SERVER["SERVER_PORT"] : "";
$url .= $_SERVER["REQUEST_URI"];
return $url;
}
$url = 'https://www.dropbox.com/1/oauth2/authorize?client_id=<clientID>&response_type=code&redirect_uri='.get_current_url().'&state=abcdefghijklmnopqrstuvwxyz';
header("Location: ".$url);

r_print($_GET['code']);

I get the error:

Error (400)

It seems the app you were using submitted a bad request. If you would like to report this error to the app's developer, include the information below.

More details for developers

unknown field "code"

Also I'm not redirected back to the Redirect URI.

Can you please tell me what is missing here?

Greg-DB

The loadFromJsonFile method is the way the PHP Core SDK loads configuration settings, and isn't itself relevant to the OAuth flow.

Regarding the actual error you're getting, it looks like you're supplying a 'code' URL parameter, but that's not expected. As seen in the code you supplied, there is a 'response_type' parameter for which the value should be 'code'.

If you need help with that, please supply the actual URL of the page for that error you're getting.

Priya M.

Hi,

>>Regarding the actual error you're getting, it looks like you're supplying a 'code' URL parameter, but that's not expected. As seen in the code you supplied, there is a 'response_type' parameter for which the value should be 'code'.

I didn't exactly understand you here. Don't we have to provide the 'code' parameter in the URL? Then how do we do that?

As you can see in the code snippet I provided previously, I've used 'response type' parameter as 'code' only.

The URL of the page where I'm writing the code is:

http://localhost/soft/softaculous/enduser/index.live.php

The URL to which Dropbox redirects after accessing this page is:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&redirect_uri=http://localhost/soft/softaculous/enduser/index.live.php&state=abcdefghijklmnopqrstuvwxyz

This asks for the Authentication permission on allowing which redirects here:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&redirect_uri=http://localhost/soft/softaculous/enduser/index.live.php?state=abcdefghijklmnopqrstuvwxyz&code=ttlP27R0ozAAAAAAAAAAVlGD6hF4EEH6VXcsJYJQmxE&state=abcdefghijklmnopqrstuvwxyz

And get the error:

Error (400)

It seems the app you were using submitted a bad request. If you would like to report this error to the app's developer, include the information below.

More details for developers

unknown field "code"

Priya M.

Hi,

How can I get a faster support? I really need to speed up things here.. Is it possible to contact you on skype or something?

Priya M.

Hi,

I'm also trying to generate the oauth2 access token using the oauth1 token and token secret in the following way:

function converttov2($access_token){
$cheaders = array('Authorization: Bearer <ACCESS_TOKEN>',
'Content-Type: application/json',
'Dropbox-API-Arg: {"oauth1_token":"'.$access_token['t'].'", "oauth1_token_secret":"'.$access_token['s'].'"}');
$ch = curl_init('https://api.dropboxapi.com/2/auth/token/from_oauth1');
curl_setopt($ch, CURLOPT_HTTPHEADER, $cheaders);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

echo '<br />Response:';
echo $response;

echo '<br />Curl Error: '.curl_error($ch);
curl_close($ch);
}

I'm getting this as output:

Response:Error in call to API function "auth/token/from_oauth1": Invalid HTTP header "Authorization": expecting "Basic" auth
Curl Error:

Can you please tell me what I'm doing wrong here?

Greg-DB

We're not currently set up to provide phone/Skype support but I'm happy to help on the forum.

Anyway, you supplied this /authorize URL:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&redirect_uri=http://localhost/soft/softaculous/enduser/index.live.php?state=abcdefghijklmnopqrstuvwxyz&code=ttlP27R0ozAAAAAAAAAAVlGD6hF4EEH6VXcsJYJQmxE&state=abcdefghijklmnopqrstuvwxyz

That does have a 'code' URL parameter, but it looks like it's supposed to be part of the redirect URI. It's not encoded though, so it gets sent as a parameter to the Dropbox page. Instead, you would need to encode the entire redirect URI value.

It looks like you have an extra redirect to /authorize anyway though, so that one shouldn't be necessary. You aren't supposed to provide the 'code' to Dropbox. Dropbox generates the authorization code and gives it to you. That is, the flow should look like this for you:

1. User goes to:

http://localhost/soft/softaculous/enduser/index.live.php

2. Your page there sends them to:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&state=abcdefghijklmnopqrstuvwxyz&redirect_uri=http://localhost/soft/softaculous/enduser/index.live.php

3. Once the user authorizes the app, they're sent to:

http://localhost/soft/softaculous/enduser/index.live.php?state=abcdefghijklmnopqrstuvwxyz&code=ttlP27R0ozAAAAAAAAAAVlGD6hF4EEH6VXcsJYJQmxE

4. Your app verifies the state, and uses the authorization code to get an access token.

Greg-DB

If you already have an OAuth 2 access token for the user, you don't need to call /2/auth/token/from_oauth1.

If there is an OAuth 1 access token you want to upgrade though, the issue is that the /2/auth/token/from_oauth1 endpoint uses "app auth", so you shouldn't supply an OAuth 2 access token. That is, this line should be like:

$cheaders = array('Authorization: Basic <base64(APP_KEY:APP_SECRET)>',

The app auth documentation has a sample.

By the way, I redacted it for you, but for the sake of security, you should disable that access token that you posted. You can do so by revoking access to the app entirely, if the access token is for your account, here:

https://www.dropbox.com/account/security

Or, you can disable just this access token using the API:

https://www.dropbox.com/developers/documentation/http/documentation#auth-token-revoke

Priya M.

Hi,

Thank you for your response.

>>That does have a 'code' URL parameter, but it looks like it's supposed to be part of the redirect URI. It's not encoded though, so it gets sent as a parameter to the Dropbox page. Instead, you would need to encode the entire redirect URI value.

Can you please provide me with an example? Also how do you suggest we should encode the URL?

I followed the exact steps as specified by you in the previous response:

1. User goes to:

http://localhost/soft/softaculous/enduser/index.live.php

2. The page there sends them to:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&state=abcdef...

3. Once the user authorizes the app, I'm redirected to the URI:

https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&state=abcdefghijklmnopqrstuvwxyz&redirect_uri=http://localhost/soft/softaculous/enduser/index.live.php?state=abcdefghijklmnopqrstuvwxyz&code=ttlP27R0ozAAAAAAAAAAYNqniSjVvXFo9mOqJ4qALX4

and get the error specified previously. (unknown field "code")

Ideally, I should be redirected to 'http://localhost/soft/softaculous/enduser/index.live.php?state=abcdefghijklmnopqrstuvwxyz&code=ttlP27R0ozAAAAAAAAAAYNqniSjVvXFo9mOqJ4qALX4' as specified by the Redirect URI but I'm not redirected to that URI for some reason and instead getting the error.

In the APP, I specified the Redirect URI as: http://localhost/soft/softaculous/enduser/index.live.php

Awaiting your reply.

Greg-DB

It looks like you have an extra redirect in the flow you have implemented. Specifically, you shouldn't be doing step 3. You should only direct the user to /oauth2/authorize once. It appears your app is directing them again a second time, including the extra 'code' parameter the second time.

This blog post may be helpful:

https://blogs.dropbox.com/developers/2013/07/using-oauth-2-0-with-the-core-api/

When encoding URL parameters, you can use whatever standard URL encoding library is available on your platform.

Priya M.

Hi,

Thank you for your response.

I got it now.

Should I encode only the redirect URI ('https://www.dropbox.com/1/oauth2/authorize?client_id=6i45k3fi9a1i9an&response_type=code&state=abcdefghijklmnopqrstuvwxyz&redirect_uri='.rawurlencode(get_current_url())) or the complete URI? When I'm encoding the complete URI, I'm getting errors.

Priya M.

Hi,

Now while obtaining an access token, I'm making the curl call to the token endpoint. I cannot make use of the CLI curl command as stated in the example here: https://blogs.dropbox.com/developers/2013/07/using-oauth-2-0-with-the-core-api/

So I'm making a curl call as:

$auth_code = $_GET['code'];
$acc_url = 'https://api.dropboxapi.com/1/oauth2/token';
$post = array('code' => $auth_code,
'grant_type' => 'authorization_code',
'client_id' => '6i45k3fi9a1i9an',
'client_secret' => '<redacted>');

// Set the curl parameters.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
// Turn off the server and peer verification (TrustManager Concept).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Get response from the server.
$resp = curl_exec($ch);
echo '<br />Curl Error: '.curl_error($ch);
echo '<br />Curl Response: ';
r_print($resp);

I'm getting the response as:

Error(405):

Something went wrong. Don't worry, your files are still safe and the Dropboxers have been notified. Check out our Help Center and forums for help, or head back to home.

How can I get a detailed error explaining the issue? What wrong am I doing?

Greg-DB

You should only encode your redirect URI ( http://localhost/soft/softaculous/enduser/index.live.php ) since it's being provided as a URL parameter, and not the /authorize URL itself where you send the user to authorize your app.

A 405 error should indicate that you're using the wrong HTTP method. The /oauth2/token endpoint requires the POST method. It looks like you're using that (since you're setting CURLOPT_POST), but I notice that you're actually calling $url, when you set /oauth2/token to the $acc_url variable instead. Please make sure you're calling the right endpoint.

Also, we highly recommend against disabling SSL/TLS verification.

Priya M.

Hi,

Ahh that was a silly mistake I made. I corrected it and now getting this:

{"error_description": "redirect_uri mismatch", "error": "invalid_grant"}

Can you tell me why?

Also regarding SSL/TLS, we'll have users having or not having SSL/TLS verification on their servers. We would require the support for all kind of servers. May I know the issue?

Priya M.

Hi,

Is it possible to get a faster response please?

Priya M.

Hi,

I'm able to resolve the previous error.

I have a doubt though. While implementing Dropbox, our user can make auth & token generation calls from various pages. Sometimes those pages may have and sometimes may not have the parameters. We cannot fix them. But according to this v2 of Dropbox APIs, the redirect URL has to be specified in the Dropbox App.

How can we handle this?

Greg-DB

As a matter of security OAuth 2 redirect URIs are required to use https:// not http://.

Likewise, also as a security feature, OAuth2 redirect URIs must be pre-registered exactly.

One thing you may be able to do instead is to use one static redirect URI but encode the necessary information in the 'state' parameter, and decode it as necessary after the redirect back to your app, to handle it as necessary:

https://www.dropbox.com/developers/documentation/http/documentation#authorization

Alternatively, you could forgo using a redirect URI entirely. With the "code" flow, you can omit redirect_uri and have the user copy and paste the code manually.

Priya M.

Hi,

Thank you for your reply.

>>One thing you may be able to do instead is to use one static redirect URI but encode the necessary information in the 'state' parameter, and decode it as necessary after the redirect back to your app
We cannot have one static URI as it varies panel to panel. On cPanel it is different, on DA it will be different, etc. On cPanel it will be different from session to session as well.

Since we want to make it automated, we don't prefer to ask users to copy paste the code.

Do you have some better solution to this? Can't we add some variables or something in the Redirect URIs of MyApps page?

Greg-DB

No, unfortunately I don't have another solution to offer. Dropbox OAuth 2 redirect URIs don't support variables.

To clarify though, the static redirect URI technique may still work for you. In your case, it sounds like you could encode the relevant panel URL in the 'state' parameter, and perform the necessary redirect from your own server.