Re: Uploading large files directly from web application.

For large files, i know it's not a good practice to expose the credentials, but...

1 - get the token from server-side

2 - use the token to upload from client-side and once the upload starts (or the first bytes are sent), send to server-side to refresh the token.

I guess that, once the upload process start, the token is no more necessary, so you can refresh it.

Also, using a second account (a free one) to just use as upload and move the file to a paid account as soon as the upload finish.

You can use the refresh process (that is, calling /oauth2/token with grant_type=refresh_token) to get a new short-lived access token using a refresh token at any time, but doing so does not invalidate previous short-lived access tokens.

You can use /2/auth/token/revoke to revoke an access token, but that will also revoke the corresponding refresh token and other short-lived access tokens for that refresh token, if any.

Dropbox also does not offer a guarantee on the timing as to when during the connection/API call the authorization check occurs, so I would not recommend relying on that.