Child Item

Simple Web App for getting info about a Dropbox Folder Content or File but Authorisation says NO??

Hey there all!

I am quite new to all this. However I have working on a Webflow site that uses xano for the database and wized to run API calls and javascript functionality.

I am on a Business Plus Account

So I was very excited that I could use API calls such as 2/files/list_folder to get a list of content within a directory. I was generating the token and found it strange that I had to keep renewing it but after a quick search I did see you could resolve this.

However now I am actually to implement this and its very difficult for starters but looks its made to prevent my use case since it requires the user to authenticate itself through Dropbox website.

Now as mentioned this is a team space and this is an internal web app. I would ideally like to have the authorisation done in the backend. Not pushing the user to authenticate themselves to see the contents of the files through my web app.

I am happy to use any method that would enable this. I did see something about 'offline' access but I dont fully understand this. Could anyone please point me towards the right direction?

Kind regards

Find more posts tagged with

Developers

Accepted answers

Здравко

Hi @eni8ma,

Yes, it's possible to pre-generate needed data (primarily refresh token) and latter use it. Keep in mind that you have to avoid credentials exposing (either access or refresh token) while your application works (that would be security issue). Take care with that part of design! Example of refresh token generation by yourself may be seen here. Once you have it, you can initialize one of Dropbox SDKs of your choice and proceed further without further user interaction. Also, you can perform API calls on your own (without official SDK), but you should take care to refresh access token as described (all SDKs do this internally) - the choice is yours. 😉

Hope this clarifies matter.

All comments

Здравко

Hi @eni8ma,

Hope this clarifies matter.

Greg-DB

@eni8ma Здравко is correct; for long-term unattended access, you should request offline access in order to get a refresh token. This only needs to be authorized by the user once manually. Refer to the following resources for more information:

eni8ma

Thank you so much for your response!

This gives me hope indeed, looks like I could actually implement this. Will try it out and thanks for the link, there is quite a in depth tutorial to do this so again thanks!

eni8ma

Ok, it does make sense so I can just do the initial setup and let the refresh tokens run periodically. Thanks for the links!

eni8ma

Hello again, I was hoping you help with trying to get this to work a bit.

I keep getting the following error: {"error":"unsupported_grant_type","error_description":"missing required field \"grant_type\""}

I tried a few different options with the help of Chat GPT but it keeps giving me this, my app key and secret are valid also my access code has been generated and its entered correctly too!

CleanShot 2024-05-16 at 18.28.26@2x.png

Здравко

@eni8ma, You don't need to implement that part if it isn't needed on client side. So skip that part and use curl instead.

It's not a good idea usage of any AI, by the way!!! Does your own intelligence miss? 🙂😁😉

eni8ma

Yes I actually gave up on it and used an online curl command runner. I have received the refresh token alongside a 4 hour access token and then I tried to refresh the access token using again the online curl editor and it worked but please just to confirm now that I have the refresh token this can be used to refresh tokens and does not expire right? Therefore I would not need to authorise my app again.

I know I should not rely on AI but it has helped with some issue but in some cases it can point you in the wrong direction for sure 😂

I hope I can learn more as I do need to have the refresh function running on my platform to give me new access tokens. Am gonna try now to see if I can get the function to work in the Javascript in wized!

Здравко

Refresh token doesn't expire; only access token expire.

For regular API calls only access token may be used! SDK client may be initialized with refresh token - it acquires access token as needed when initialized properly.

eni8ma

Thank you guys I have managed to get this working but I do have another question on this topic.

--header "Authorization: Basic NmZoNnl5ZmNh.......

So from the developer tools I have managed to test some APIs however before i was always using the sl ....... token which I had to specify the user - Dropbox-API-Select-User and path the path root Dropbox-API-Path-Root.

This token from the documentation page Basic NmZoNnl5ZmN.... seem to work fine without refreshing it. So my question whats the difference and which one should I be using.

My use case would be to access the Shared Workspace Folders and Contents not the user specific folders?

Thanks!

Greg-DB

@eni8ma A "Basic" value used in the "Authorization" header corresponds to "App Authentication". A "Bearer" value used in the "Authorization" header corresponds to "User Authentication" (or "Team Authentication").

User (or Team) Authentication are used to access a specific user account (or team).

App Authentication is used by certain endpoints/use cases where a specific account/team is not needed, and so this only involves authenticating the app itself. This only uses the app key/secret, not an access token, and so does not expire and does not need to be refreshed.

You can see which authentication type(s) any given endpoint supports in the documentation.

Здравко

@eni8ma, don't mess different authentication types!

If you need to manage public data (like shared link and files etc) then basic authentication is enough. If you need to manage account specific data, you need bearer authentication!

Note: Basic authentication authenticates your application only, while bearer - authenticates the user. So you CANNOT do anything user related (including any file/folder direct access) without bearer authentication.

Hope it's a bit more clear now.

eni8ma

Ok so I think I understand this

Bear Authentication to access user specific folders (which I don't need to)
App Authentication to access team spaces. (which I do want to access)

So in my workspace I have a team space folder which has multiple folders, these folders have been shared and I want to list these directories via the API call.

What I was doing before is using bearer but then accessing the root folder of the shared workspace, which am guessing is not right method and I should be using the App authentication?

Regards

Здравко

Hmm... 🤔 Are your team data public??...

Sarcasm... of course...🙂

eni8ma

CleanShot 2024-05-17 at 15.31.27@2x.png

It's available in everyone in the group and folders inside have been shared with a sharable link.

Здравко

@eni8ma wrote:
...
It's available in everyone in the group and folders inside have been shared ...

Can I access this group data? 🤔 If you need to manage something non accessible with public link, you need bearer authentication. If you only need access link pointed data (link created in advance), then basic is enough. 😉

PS: It doesn't matter where data reside in.

eni8ma

Ok understood thanks, I will need to think this through I appreciate the help!