Dropbox API Certificates Move to a New Root in 2026

Dropbox has announced that its API servers will begin using certificates issued from a new root certificate authority starting on or after January 1, 2026. The change is necessary because the current root certificates will no longer be trusted by many web browsers and devices in 2026.

Several official Dropbox SDKs currently implement certificate pinning based on a bundled list of root certificates. Apps that use these SDKs must be updated to maintain uninterrupted access to the Dropbox API once the server certificates change.

Affected SDKs and Required Versions

The following SDK versions have been updated to remain compatible with the new server certificates:

  • Java SDK — v7.0.0 or greater
  • .NET SDK — v7.0.0 or greater
    • Apps using older .NET SDK versions are only affected if they call DropboxCertHelper.InitializeCertPinning().
  • Python SDK — v12.0.2 or greater

Developers using any of these SDKs should update their applications to the latest versions as soon as possible.

SDKs Unaffected by the Change

The following official Dropbox SDKs do not implement certificate pinning and are not affected:

  • JavaScript SDK
  • Objective-C SDK
  • Swift SDK

Third-party libraries may or may not be impacted. Developers are advised to consult the documentation for any third-party library they rely on.

Questions can be directed to Dropbox through the developer forum or the contact form.