Long-lived access token deprecation

First, for reference, note that there are two changes covered in that post, so I'll clarify each. While we started these at the same time, they are not technically tied together and can be applied separately:

1. Permissions/Scopes change: New apps can only be registered as scoped apps, and existing apps can be migrated to be scoped apps. We have not automatically migrated existing non-scoped apps to be scoped apps, but may do so in the future. We do recommend migrating any existing apps at your earliest convenience.
2. Token change: Dropbox is phasing out the ability to create new long-lived access tokens. I don't have more specific timing information, but as you mentioned, Dropbox is rolling out this change very gradually to minimize disruption. While this rollout is mostly complete, some small number of apps may still be receiving new long-lived access tokens. (We don't currently have a plan to disable existing long-lived access tokens; if that changes, we will of course announce that ahead of time.) If you have any questions about or need help with the state of any particular API app, please open an API ticket from the account that owns the app in question. In any case, we do recommend migrating to using short-lived access tokens and optionally refresh tokens at your earliest convenience. Regardless of the state of the rollout for an app, you can opt in to the short-lived access token and optional refresh token behavior by explicitly setting the token_access_type parameter on /oauth2/authorize to "online" or "offline" accordingly.