Child Item

Access without an "app"

Hey,

I was wondering if it is possible to access a dropbox account without the token generated in the app console.

What I mean is, can I use an api on my python script that will query an input dropbox account (and password obviously) for files and then retrieve it?

As far as i've seen, I can only connect via the token to the account that generated it.

Thank you

Find more posts tagged with

API

Abuse

Accepted answers

Greg-DB

Yes, that's correct.

All comments

avstudio

I think it is possible, I access to my account from the computer without any verification code, maybe if you look up in your profile page in settings > Security, there are many options to try.

Greg-DB

@mbm123 Performing Dropbox API calls, such as to list and download files from a Dropbox account, does require an access token; they can't be performed using the account username and password directly.

mbm123

I thought that much, but then how do applications such as Total Commander integrate Dropbox?

As far as I remember, you can "connect" your dropbox account into Total Commander and it will behave just like the actual dropbox app, download/upload files as expected.

Greg-DB

@mbm123 Third party apps enable end-users to connect their Dropbox accounts by implementing the OAuth app authorization flow. This is a way for third party apps to ask the user to allow the app to access the user's account. When the user approves an app using this flow, the app is given an access token. You can find more information on how this flow works in the OAuth Guide and authorization documentation.

mbm123

Thank you for the answer, but let me stress this matter just a bit more 😉

Can I do that within a hosting server?

Webpage that wraps dropbox upload download.

Nothing malicious, just for home use.

Greg-DB

@mbm123 It's not possible to perform the entire OAuth app authorization flow within your own app only. The user needs to be sent to Dropbox to indicate to Dropbox whether or not they want to authorize the app. If they do approve it, Dropbox itself then generates the token(s).

Note though that you only need to do this once per user. The app can store and re-use the resulting access/refresh tokens without further manual interaction.

mbm123

So it should be possible for me to ask a user to register with username and password, redirect it as a query for dropbox in order to generate a permanent token, save this token and use it later to download/upload files for this user?

could this operation be restricted to a specific path?

for example, if i want to share FAMILY folder from my dropbox (/FAMILY/), and do so for my other family members, they just need to "login" on my webpage with their dropbox credentials, then i do the token thing mentioned above?

Greg-DB

@mbm123 Assuming you're referring to the username/password for your own app (that is, your app should never request or handle Dropbox username/passwords directly), yes, you can have the user log in to your own app, and then send them through the Dropbox app authorization flow to request access to their Dropbox account. Once they do so, you would use the resulting access token/optional refresh token to later make API calls for their account, such as to upload/download files.

(Note that if you only need to access your own account, you could just use your own access/refresh token instead of having each user add the shared folder to their own account and authorize the app to access their account. Note that you shouldn't expose your access/refresh token to other users though, so in this case you should make sure to only keep the token(s) on the server and not exposed to the client.)

Dropbox does not offer the ability to grant an app/access token access to specific existing folder(s) only, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.

For reference, the "Dropbox API" currently offers two levels of file access: "app folder" and "full Dropbox". Access tokens for apps with the app folder access type can only access the contents of the special app folder created for the app in the connected account. App folders can't be set to existing folders or combined with shared folders or team folders though.

Access tokens for apps with the full Dropbox access can access anything in the connected account, including shared folders. You can find more information about the different permissions here.

mbm123

That's a lot of information, thank you very much, also for the initiative to forward my humble suggestion.

I will get more familiar with the api and the documentation you linked and further this discussion (or open a new thread?) once deeper questions arouse.

Thank you once again.

mbm123

Hey again.

I read through some API (python) and managed to create an app, generate my personal token and send file requests to dropbox.

That's nice, but I would like to be able to ask for username/password, instead of redirecting a user to the token page.

I found this example:

https://github.com/dropbox/dropbox-sdk-python/blob/main/example/oauth/commandline-oauth.py

tl;dr

in the example it asks the user to:

print("1. Go to: " + authorize_url)

print("2. Click \"Allow\" (you might have to log in first).")

print("3. Copy the authorization code.")

Seems kind of silly, why can't i do it for the user with username/password?

I hope I made myself clear, I tried 🙂

Greg-DB

OAuth 2 is an industry-standard protocol for authorization. Dropbox uses it to enable end-users to connect third party applications to their accounts without disclosing their credentials to the third parties.

mbm123

I understand, so I cannot (and should not) ask the user for username/password and "do it myself" for the user.

I can open the link to the token generation, where the user will login and generate a code, which he would then pass to me, and revoke in case he wishes to cease the communication.

I got it right?

Greg-DB

Yes, that's correct.

vimalapalanisamy22

Currently we are using few Dropbox api method. We are using Authorization flow in which response code ,scope ,client id passed.this will give me Authorization code and i need to pass them to token api which will return access token. Is there any way to automate this process- exchanging Authorization code for access token. Or Dropbox can use api for Authorization flow for instead of this website.

Greg-DB

@vimalapalanisamy22 No, it is not possible to automate the app authorization flow. That will need to be processed manually once per user. The resulting access token and optional refresh token can be stored and re-used programmatically. Refer to the OAuth Guide and authorization documentation for more information.

vimala_palanisamy22

Let's say ,I am team admin in my team there are 3 members-not admin role are there ..all of them are creating full Dropbox apps. I have added them in the settings->app permission ->other apps..now as a team admin how can I generate a token for the apps that was created by other members without using Authorization flow.

Greg-DB

@vimala_palanisamy22 You cannot get an access token for someone else's app without using the OAuth app authorization flow. If you need an access token for someone else's app to connect to your account, you will need to use the OAuth app authorization flow as documented. (The owner of an app can use the "Generate" button on the app's page on the App Console to create an access token for their own account for that app without using the actual OAuth app authorization flow, but that is only available to the owner of the app in particular.)

vimala_palanisamy22

I have doubt like , i am team admin, I don't have created business app or neither my team members. In such case how can we create access token for calling APIs with team authentication

Greg-DB

@vimala_palanisamy22 Connecting an app to a team works the same way as connecting an app to a user account. You would use the OAuth app authorization flow (or the app owner can use the "Generate" button if they just need a short-lived access token), but the developer would enable the relevant "team" scope(s) first.