You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
Oauth2 refresh token question - what happens when the refresh token expires?
I've been testing the Dropbox OAuth2 endpoints for a few days and I have read the documentation provided directly by Dropbox. However, it is not clear to me how I'm supposed to handle the acquisition...
While Dropbox "short-lived access tokens" do expire automatically, "refresh tokens" do not. When your app gets a refresh token, it can use that to continuously get new short-lived access tokens whenever needed, without further manual user intervention. (The Python SDK actually does that for you automatically.)
So, since Dropbox refresh tokens do not expire automatically they can and should be re-used repeatedly. The app will not receive a new refresh token every time it requests a new short-lived access token. It should just store and continue re-using the same one.
They can be revoked manually though, either by the user (e.g., via https://www.dropbox.com/account/connected_apps ) or the app, at which point the app would need to prompt the user to re-authorize the app if they wish to use it again.
Greg-DB
Dropbox Staff
Dropbox StaffWhile Dropbox "short-lived access tokens" do expire automatically, "refresh tokens" do not. When your app gets a refresh token, it can use that to continuously get new short-lived access tokens whenever needed, without further manual user intervention. (The Python SDK actually does that for you automatically.)
So, since Dropbox refresh tokens do not expire automatically they can and should be re-used repeatedly. The app will not receive a new refresh token every time it requests a new short-lived access token. It should just store and continue re-using the same one.
They can be revoked manually though, either by the user (e.g., via https://www.dropbox.com/account/connected_apps ) or the app, at which point the app would need to prompt the user to re-authorize the app if they wish to use it again.
Hello there. I understand that the refresh tokens are needed in order to continuously use the app without expiration. I do not understand where to find this refresh token. can someone help? thank you
Hi Zachjaryw,
It's not possible to get refresh token in the same way as was for long lived access token - from your application's profile (not yet at least), if that's what you are asking for. You have to perform authentication and save the refresh token at the end. Can be used different ways; one such simplified could be seen here. 😉
Hope this helps.
Thanks for the response. Just to be sure I'm understanding:
- I need to store the refresh token from the original authentication call.
- When the access token expires, the original refresh token can be used to generate a new access token.
Is that correct? Also, what happens if you lose the refresh token? It doesn't make a lot of sense to force the user to authenticate via URL a second time, but that's the only way I know how to get a new access token without a refresh token using any of the flows. Am I missing something or is that right?
- Greg-DB
Yes, that's correct.
And yes, a refresh token is needed to programmatically retrieve more short-lived access tokens, so if you lose the refresh token you'd need to send the user through the authorization flow again to get a new one.
Got it. Thanks. Do you happen to know where I can read about this in the documentation? I can't find the information you're explaining and I'm not sure how the SDK stores the token or if it's safe. Does it put the token in a plaintext file on the disk somewhere?
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
