Child Item

Python: Example of full OAuth2 flow with refresh

Hi folks,

I have been working on a Python script to read information from my Dropbox account. The Dropbox OAuth SDK examples only demonstrate the initial part of the flow and do not use the refresh token. I could not find a working example despite searching the Internet (and this forum).

After a bit of trial-and-error, I have a posted working example on GitHub: Dropbox Command-line OAuth with Refresh.

Once the user has authorized Dropbox access, the script saves the resulting refresh token in .env. Subsequent executions of the script do not require any user intervention -- the refresh token is used instead.

The key bits I learned along the way:

1. This is sufficient to obtain an initial refresh token:

    flow = DropboxOAuth2FlowNoRedirect(
        APP_KEY,
        APP_SECRET,
        token_access_type="offline"
    )

2. Once the refresh token has been obtained, this is sufficient to access Dropbox:

    with dropbox.Dropbox(
        app_key=APP_KEY,
        app_secret=APP_SECRET,
        oauth2_refresh_token=refresh_token
    ) as dbx:

3. There is no need to use the access token.

Find more posts tagged with

Developers

Comments

Здравко

@donaldm314 wrote:
...
3. There is no need to use the access token.

Hi @donaldm314,

In general Yes, you don't need to use access token explicitly when initialize your client object on any Dropbox SDK (including Python). The client object takes care to take access token alone/unassisted once initialized properly. Just to avoid confusion - API always needs access token, but SDK takes care for that in such cases.

Depending on what's the usage profile of your application just a proper object initialization with refresh token only may be enough (in cases when typically your application runs for long time and relatively rare reinitialized). In opposite situation (when your application runs as a command line, for instance, and the client object life is relatively short with few real API calls), it may be useful to keep track of the access token in use. In such a way you avoid too often refreshing that may affect your application performance. Example of such an use case (all together - OAuth flow, authentication save, and real calls) can be seen here.

Good luck.