Dropbox API adds OAuth scopes, PKCE, and refresh tokens
Dropbox has expanded its OAuth 2.0 authorization support with three new capabilities: scopes, PKCE, and refresh tokens. Together, these features give developers finer control over the permissions an app requests, better security for public clients, and a safer model for background access.
Granular permissions with scopes
Previously, Dropbox apps were defined by fixed "types" that granted predetermined access to API calls. Scopes replace that model by associating each API call with an individual permission scope, which you can request selectively at authorization time. This allows for minimal-access design: an app can request only the permissions it genuinely needs rather than accepting an all-or-nothing bundle.
Scopes also make it possible to expand permissions incrementally. An app that initially only verifies a user's identity can later request file viewing, editing, or sharing permissions only when those features are needed. Team permissions can be requested the same way, which eliminates the need to maintain separate apps for the User API and the Business API.
Apps built on scopes also display new OAuth consent screens to end users that explain precisely which permissions are being requested.
Better public-client auth with PKCE
Dropbox now supports PKCE (Proof Key for Code Exchange), an OAuth 2.0 extension that uses dynamically generated client secrets. PKCE is designed for public clients that cannot store a static client secret securely, and it is a more robust alternative to the implicit grant flow for such applications. Developers building desktop apps, mobile apps, single-page JavaScript applications, or open-source projects—or deploying to infrastructure outside their control—should use PKCE.
Refresh tokens for background access
The API also now supports refresh tokens alongside short-lived access tokens. This pattern improves security compared with long-lived access tokens, since credentials expire more frequently and can be renewed without user interaction. Apps that need to perform background operations should adopt this flow. Refresh tokens do require extra implementation work, but the Dropbox SDKs have been updated to handle much of the complexity.
No immediate migration needed
Existing apps are unaffected by these changes. Legacy app and token types remain available in the developer console, and there is no requirement to migrate immediately. Dropbox says it will eventually retire the legacy types but will give developers ample notice beforehand. Apps that want to move now can update their permissions to scopes, incorporate PKCE, or switch to refresh tokens via the App Console.
For implementation details, start with the updated Dropbox OAuth guide. Questions and feedback can be posted on the Dropbox API forum.
