How can i get an acces token without a login?

Hi @Alex_Ch,

Since you want to access your own account (not user's accounts), the best way would be to implement the entire communication to your Dropbox account (or the communication management, at least) on your server side. In such a way you can use pre-generated refresh token usable to refresh your access token (generation whenever needed - something performed automatically when official SDK is in use). There is no way access token to be generated completely without user confirmation (the your confirmation in particular case - your account is the target), but once refresh token is generated you can use it without further interaction from your side or your site's users.

One scenario is on post the pdf, it flows to your site and next from your site to Dropbox (i.e. your site behave like a proxy). Other scenario is on user intent to post, on your site a temporary upload link to be generated and the pdf to be uploaded directly to Dropbox (without passing through your site) using this link. In the both cases you don't expose any credentials to the user's browser, something that should be followed (or is advisable, at least).

Hope this gives direction.

All comments

Hi @Alex_Ch,

Hope this gives direction.

@Alex_Ch I see Здравко already offered some helpful guidance.

For more information on the OAuth flow, for retrieving a refresh token, refer to the following resources:

And the documentation for the endpoint for generating a temporary upload link can be found here:

https://www.dropbox.com/developers/documentation/http/documentation#files-get_temporary_upload_link

excuse me but, how could i use the http request to refresh the access token in the sdk for javascript?

@Alex_Ch wrote:
excuse me but, how could i use the http request to refresh the access token in the sdk for javascript?

You can use raw http request, but you don't need to do that. As I said you can use SDK and in every SDK (including Dropbox Javascript SDK) are equivalent calls. It's your decision what you will use (depending on your development environment server side - you haven't mentioned what are you using there till now).

Add: You may have skipped what I wrote above and I will repeat again. When your use some SDK (doesn't matter what exactly) the refreshing is performed automatic internally. You don't need to do more that proper client object initialization. Everything else is the same.

@Alex_Ch Здравко is correct, the official Dropbox SDKs, such as the Dropbox JavaScript SDK, will handle the refresh for you automatically as long as you supply the necessary credentials (refresh token, app key, etc.). You can find an example of that for the Dropbox JavaScript SDK here.

Hello again, excuse my delay.

I`ve been studying the documentation and the SDK example, and I have a question.

I`m not get used to using express js, so I'm a little bit lost with that. Where does the parameter "code" comes from? I`ve tried with the token I already have, but I get a 400 code.

Hi @Alex_Ch,

You don't need to embed this part of the code; focus on the line that Greg enlightened and shows how you can set refresh token (one of the possible ways). You can take a look here how you can get all needed by hand; it's one time action. The last action described in the post, I linked to (the only repeatable), gets performed by the SDK internally.

@Alex_Ch As Здравко said, you shouldn't be embedding and re-using the 'code'. The 'code' value is the "authorization code", which can only be used once. You should instead store and re-use the "refresh token" once you have it.

Ok, I´ve been testing and I think I got it.

Just one more question, how do I pre-generate the refresh token? (I think I should start with that, I apologize for that)

@Alex_Ch It is not possible to "pre-generate" the refresh token. A refresh token can only be retrieved by authorizing the app using the app authorization flow. The refresh token doesn't expire though, so that only needs to be done once per Dropbox account (though the refresh token can be revoked on demand).

@Alex_Ch wrote:
...
Just one more question, how do I pre-generate the refresh token? ...

@Здравко wrote:
... You can take a look here how you can get all needed by hand; ...

... all needed, including refresh token. 😉

In the SDK for javascript that`s the "get access token from code"?, how could I use it to get the refresh token?

@Alex_Ch wrote:
... "get access token from code"?, how could I use it to get the refresh token?

You cannot! Access token is generated from refresh token, not opposite!!! Didn't you read all posted till now? 🤷

@Alex_Ch When using the OAuth app authorization flow, Dropbox gives an "authorization code" (sometimes also called "access code") that can be exchanged (once) for the access token and optional refresh token. As Здравко said, that resulting refresh token can then be used to retrieve further access tokens as needed. There's an example of that flow in this blog post. That's the same flow implemented by the JavaScript SDK, such as in this example.

Excuse me if I confuse with something, this topic is kinda new to me

I`ve been testing the auth flow, and when I tried to get the authorization code I got a login screen. Is there another way to get the authorization code without that login? The app only needs access to my own account

@Alex_Ch wrote:
... Is there another way to get the authorization code without that login? ...

No, it's not.

@Alex_Ch wrote:
... The app only needs access to my own account

Ok, so you need to perform OAuth (including receiving access code) once, as Greg said, and no more. Once you have refresh token you don't need to open any login screen. The refresh token, application key, and (optionally - becomes mandatory for no PKCE) application secret are enough for automatic access token regeneration without any further user interaction (including interaction to you).

Ok, I think I finally got it.

Just one more thing. In the SDK for javascript, I tried to use the command "refreshAccessToken", but it doesn´t read the scopes, I always get the "Scope must be an array of strings" error, even when I define the array in the property.

Where could I find an example of that command? I think I´m using the syntax wrong

@Alex_Ch You do not need call refreshAccessToken yourself, unless you need to retrieve a client with a sub-set of the authorized scopes. The SDK will automatically perform the refresh process for you automatically for the currently authorized scopes without you calling refreshAccessToken in your own code.

If you do want to call refreshAccessToken explicitly though, you could do so like this:

dbx.auth.refreshAccessToken()
  .then(function() {
    // ...
  })
  .catch(function(error) {
    console.error(error);
  });

To call refreshAccessToken with a specific set of scopes, pass in a list like this:

dbx.auth.refreshAccessToken(["account_info.read", "sharing.read"])
  .then(function() {
    // ...
  })
  .catch(function(error) {
    console.error(error);
  });