Child Item

Using the DropBox API to host files for a public website (.net 9 Blazor)

My client has 100,000s of images stored in dropbox. The goal is to have some database information displayed alongside any one of the images.

From what I understand, I would need need to use a service account or OAuth2 so that the visiting user never knows anything about the file location and the only access is via the owners dropbox authority via the app.

I have tried to follow the online instructions but they are varied and change from site to site and over the years.

My first step was to load this url - https://www.dropbox.com/oauth2/authorize?client_id=&token_access_type=offline&response_type=code

This returned a Code. I placed this code the below .net 9 Blazor app but I cannot get past Bad Request

refreshToken = the code I got from the above?

public async Task<string> RefreshAccessTokenAsync(string refreshToken)
{
    var client = _httpClientFactory.CreateClient();
    var request = new HttpRequestMessage(HttpMethod.Post, "https://api.dropbox.com/oauth2/token")
    {
        Content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                { "grant_type", "refresh_token" },
                { "refresh_token", refreshToken },
                { "client_id", "xxxx" },
                { "client_secret", "xxxx" }
            })
    };

    var response = await client.SendAsync(request);
    response.EnsureSuccessStatusCode();

    var json = await response.Content.ReadAsStringAsync();
    var tokenResponse = JsonSerializer.Deserialize<JsonElement>(json);
    return tokenResponse.GetProperty("access_token").GetString();
}

Are there any step by step examples that work to do the above in 2025? I'm really banging my head against the wall here.

Find more posts tagged with

API

Developers

Abuse

Comments

DB-Des

Hi @TimCadieux,

The code returned from the auth URL: https://www.dropbox.com/oauth2/authorize?client_id=&token_access_type=offline&response_type=code is an authorization code, not a refresh token.

To obtain a refresh token, you would first need to send a request to /oauth2/token with the value of the authorization code, from the first step. Below is the cURL equivalent for that request:

curl https://api.dropbox.com/oauth2/token \
    -d code=<AUTHORIZATION_CODE> \
    -d grant_type=authorization_code \
    -d client_id=<APP_KEY> \
    -d client_secret=<APP_SECRET>

The response from the above request will contain a refresh token value. You can then use that refresh token value to execute the code snippet you originally shared.

Feel free to reference our OAuth Guide and authorization documentation for any additional information.