We are aware of the issue with the badge emails resending to everyone, we apologise for the inconvenience - learn more here. 

Forum Discussion

salven's avatar
salven
Helpful | Level 6
7 years ago

API secret in dropbox.oauth.DropboxOAuth2FlowNoRedirect and redistribution

Hi,

 I am writing a simple app in the form of a python script which follows the OAuth2 procedure for the user to link and use their own account. Now, the DropboxOAuth2FlowNoRedirect() method requires both the app key *and* secret to be passed and I can't seem to reconciliate this with replies to similar questions, where it was specified that only the key is really needed. How would I go to redistribute the app without embedding (or revealing) the app key?

  • The Dropbox OAuth 2 app authorization implementation supports two different flows:
    - the "code" flow: this flow requires both the app key and secret
    - the "token" flow: this flow only requires the app key

     

    The `DropboxOAuth2FlowNoRedirect` class in the Dropbox Python SDK uses the "code" flow, so it requires the app key and secret.

     

    The Python SDK doesn't implement the "token" flow unfortunately, but I'll pass this along as a feature request. 

     

    That being the case, to distribute a client-side Python app without including the app secret, you'd need to implement the token flow yourself, either by modifying the SDK or without using the SDK at all. Note that the token flow requires a redirect URI though, so you'd need to use a local redirect URI.

  • Greg-DB's avatar
    Greg-DB
    Icon for Dropbox Staff rankDropbox Staff

    The Dropbox OAuth 2 app authorization implementation supports two different flows:
    - the "code" flow: this flow requires both the app key and secret
    - the "token" flow: this flow only requires the app key

     

    The `DropboxOAuth2FlowNoRedirect` class in the Dropbox Python SDK uses the "code" flow, so it requires the app key and secret.

     

    The Python SDK doesn't implement the "token" flow unfortunately, but I'll pass this along as a feature request. 

     

    That being the case, to distribute a client-side Python app without including the app secret, you'd need to implement the token flow yourself, either by modifying the SDK or without using the SDK at all. Note that the token flow requires a redirect URI though, so you'd need to use a local redirect URI.

    • salven's avatar
      salven
      Helpful | Level 6

      Thank you, Greg, that helps a lot.

       

       

    • Manotai M.'s avatar
      Manotai M.
      New member | Level 2
      การทำงานversionเก่ามีผลต่อการใช้งานในDropboxของฉัน

About Dropbox API Support & Feedback

Node avatar for Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

5,876 PostsLatest Activity: 4 hours ago
325 Following

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X or Facebook.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!