How to get refresh token without User interaction

It is not possible to get a refresh using an app key and access token programmatically. You can only get a refresh token using the OAuth app authorization flow.

Likewise, it is not possible to fully automate the OAuth process where the user chooses to authorize the app and the app then receives the resulting access token and optional refresh token. This needs to be done manually by the user at least once. If your app needs to maintain long-term access without the user manually re-authorizing it repeatedly, the app should request "offline" access so that it gets a refresh token. The refresh token doesn't expire and can be stored and used repeatedly to get new short-lived access tokens whenever needed, without the user manually reauthorizing the app.

You can find examples of this functionality in the Dropbox API v2 Java SDK here.

Hi @makrand kulkarni,

😁 You are in confusion. There is no way to get refresh token based on access token; the sequence is opposite! You have to get a refresh token and after that you SDK will take care for the rest (including access token generation. Take a look here and here for more info.

Hope this helps.

@Greg-DB,

Thanks, I have one more query, As Per Example Given, Auth Code needs to be Enter manually by User to get Access and Refresh Token,

For A Company Clients this could not be Implemented as there are multiple users which will use our application.

1 Is there any other solution where Auth code can be taken Internally by Application ?

2. In which Parameter Auth Code can be taken in response of redirect-uri ?

It will be great help on this .

@makrand kulkarni wrote:
...
1 Is there any other solution where Auth code can be taken Internally by Application ?
...

As you already guessed, Yes, using redirect URI.

@makrand kulkarni wrote:
...
2. In which Parameter Auth Code can be taken in response of redirect-uri ?
...

You can take a look on a web example to take idea from or on general authorization doc.

Good luck.

@makrand kulkarni Здравко is correct. While the authorization process needs to be processed manually once per user, you can use a redirect URI to make that process easier. Please refer to the resources that Здравко linked to.

@Greg-DB

I still have question that , In what Param Auth Code will get in Response of redirect URI ?

While using SDK, the care for details is usually SDKs code's task, not to the code where SDK features are called from. Though, for all possible parameters in redirect URI you can take a look on /oauth2/authorize, in RETURNS section.

Thanks, I am using Authorize URI with Token Access type as Offline

https://www.dropbox.com/oauth2/authorize?client_id=xxxxxx&token_access_type=offline&response_type=code

I want to read Auth Code Internally in Java Code return by above URI. suggest a way how to read the Auth Code by Java code only

Hi @makrand kulkarni,

As result of your request, on confirmation, new request will be directed according to then redirect URI with only parameter 'code' inside. It would look like:

<Your redirect URI>?code=<code to be used in /oauth2/token>

You can use any code able to handle your URI (either provided by Dropbox or no). Some sort of service need to be provided that serve as a callback (no direct response is possible). Typically it's a some sort of web server (local HTTP handler) or something else, depending on the URI type (is it URL or something else). You can take a look here for some web example.

Hope this gives direction.

@makrand kulkarni Здравко is correct. Please refer to the documentation they linked to for information on how this is passed on the redirect, and the example they linked to for a sample of how to handle this with the Java SDK.

@Greg-DB

Can you share more example in Spring boot for implementation of refresh token. Previous example shared by @Здравко was partially help full .

I am trying to figure out more that "is 1 drop box application be used across org ? "

@makrand kulkarni Dropbox doesn't offer a Spring Boot sample in particular, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.

https://www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize

@Greg-DB

I am following Drop box documentation

I am not able to get the "Code" embedded in Redirect URI. Sample request is

GET Method

https://www.dropbox.com/oauth2/authorize?client_id=xxxxxx&token_access_type=offline&response_type=code&redirct_uri=https://eofynre1btpc2ny.m.pipedream.net&state=xyz

In response getting Html Code /Website in Postman

As Per Documentation it should provide me Query response with Code

Any help will be appreciated.

Thanks

Hi @makrand kulkarni,

As can be seen on documentation (and on your screenshot) "Because /oauth2/authorize is a web site, there is no direct return value". What is a web site? 🧐 Ooo... it's HTML. 😉 Read more carefully.

@makrand kulkarni As Здравко indicated, /oauth2/authorize is a web page, not an API call, so you should not be accessing it programmatically. You should send the user there in their own system web browser to interactively click the button to authorize your app to access their account. If you specify a redirect URI, the user will be redirected to it upon authorizing the app and the app can parse that resulting redirected URI to retrieve the authorization code.

tkozuch

Hi Greg.

Somewhat this is still confusing for me.

I was following this example:
https://github.com/dropbox/dropbox-sdk-python/blob/main/example/oauth/commandline-oauth-scopes.py#L81
and this guide:
https://developers.dropbox.com/oauth-guide

From your comment:

@Greg-DB wrote:
If your app needs to maintain long-term access without the user manually re-authorizing it repeatedly, the app should request "offline" access so that it gets a refresh token. The refresh token doesn't expire and can be stored and used repeatedly to get new short-lived access tokens whenever needed, without the user manually reauthorizing the app.

and from the DropBox Oauth Guide:

> When using refresh tokens, your call to the /oauth2/token endpoint with the grant_type of authorization_code will return a short-lived access token and a refresh token, which should be securely stored.

so why does this endpoint return a new refresh token?

but as I understand - your comment is more correct - the Refresh Token is permanent and if I perform a "manual flow" like here:

https://github.com/dropbox/dropbox-sdk-python/blob/main/example/oauth/commandline-oauth-scopes.py#L18

and save the refresh token, I should be able to use it forever?

let's say I perform the above manual and initial OAuth flow (DropboxOAuth2FlowNoRedirect - in Python SDK), and save the refresh token and access token somewhere.

then, let's say I have a task - a script that re-runs periodically and needs to call DropBox API without user interaction - I make it read the previously saved Access and Request tokens, and make a call like this:

https://github.com/dropbox/dropbox-sdk-python/blob/main/example/oauth/commandline-oauth-scopes.py#L79C1-L83C52

?

does this mean, that after the above Dropbox client operation, I don't get a new Access Token, but the one which I saved just becomes valid again?

both the AccessToken and Refresh Token stay valid and the same all the time?

AccessToken can even become expired for a long time, and you only need Refresh Token to make a new Dropbox API connection at any time?