is it ok to upload file with username and password without app access token? if no, can I create app access token by using username and password in C#.
Thanks
No, the Dropbox API doesn't offer a way for your app to upload files or create access tokens directly from the username and password.
You should use the OAuth app authorization flow to get an access token, so your app never directly handles the user credentials. You can find more information on how this works here:
https://www.dropbox.com/developers/reference/oauth-guide
Once your app has an access token, it should store and re-use it for future calls.
Using oauth to get access token, do I need to have app key and app secrect? Is anyway we can get the access token by user credentials?
You do need to register an API app to use the OAuth app authorization flow. You generally only need to do this once though. If you haven't already, you can do so here.
To use the "token" flow, you only need the app key (and a redirect URI of your choosing); to use the "code" flow, you need both the app key and secret. You can find more information in the documentation.
