How to authenticate with a Dropbox account, via oauth2, from my browser only webapp

The "state" value for the Dropbox OAuth app authorization flow is:

Up to 500 bytes of arbitrary data that will be passed back to your redirect URI. This parameter should be used to protect against cross-site request forgery (CSRF). See Sections 4.4.1.8 and 4.4.2.5 of the OAuth 2.0 threat model spec.

Exactly what you put in it is up to you (in addition to the CSRF protection). It can be any arbitrary data/format. E.g., It could be a JSON dictionary containing information about where in your app the user was, such as what file the user was reading. (You'll probably want to URL-safe base64 encode it before you send it off though.)

The idea is that since the user will be leaving your site, you would put whatever your site would need to know when the user comes back to get them back to what they were doing. Exactly what data that would be is specific to your app.

I believe the Dropbox JavaScript SDK you're using is roughly the equivalent of the Google library you linked to. It's just a minifed JS file though, so I don't know exactly what it does. In any case though, it sounds like it serves roughly the same purpose, but the Dropbox SDK leaves the handling of your own app's state up to you.

I don't have a better example to refer you to though. It would depend on what web framework you're using anyway.