Why Skip the OAuth Library

Every Dropbox API request is signed with OAuth to verify the user and their permissions. If you build on one of our SDKs, that's handled for you. But when you need to work with OAuth directly, two recommendations make the job much easier: use the PLAINTEXT signature method from OAuth 1.0, and likely skip third-party OAuth libraries entirely.

OAuth 1.0 was designed for unencrypted HTTP, which is why it leans on cryptography. That crypto is error-prone, and unnecessary over SSL. The PLAINTEXT method exists precisely for SSL connections and is simple enough that implementing it yourself is usually less work than wrestling with an OAuth library. Libraries tend to support every signature method at once, which makes their interfaces needlessly complicated when you only need PLAINTEXT.

The full flow requires just four steps: request a token, have the user authorize your app, exchange the request token for an access token, and sign normal API calls. Sample Python code is available alongside this guide.

Getting the Request Token

First, grab an app key and secret from the My Apps page, then make a call to the request token endpoint. The HTTP request carries a header like this:

Authorization: OAuth oauth_version="1.0", oauth_signature_method="PLAINTEXT",
oauth_consumer_key="<app-key>", oauth_signature="<app-secret>&"

The response comes back as a url-encoded string with the request token and its secret:

oauth_token=<request-token>&oauth_token_secret=<request-token-secret>

You'll need to parse both values and stash them for the next step. The full request looks like:

POST https://api.dropbox.com/1/oauth/request_token

User Authorization

Next, point the user's browser to the authorization URL. The included callback URL — something like https://yoursite.com/auth_complete — is where Dropbox redirects after the user approves your app, letting your server know it's safe to continue.

https://www.dropbox.com/1/oauth/authorize?oauth_token=<request-token>&oauth_callback=<callback-url>

Swapping for an Access Token

Once the user has authorized, exchange the request token for an access token. Your HTTP request needs this header:

Authorization: OAuth oauth_version="1.0", oauth_signature_method="PLAINTEXT",
oauth_consumer_key="<app-key>", oauth_token="<request-token>",
oauth_signature="<app-secret>&<request-token-secret>"

The response is another url-encoded string:

oauth_token=<access-token>&oauth_token_secret=<access-token-secret>&uid=<user-id>

Extract the access token and secret and store them for the long term — the request token and secret can be discarded at this point. Here's the exchange call:

POST https://api.dropbox.com/1/oauth/access_token

Signed API Calls

With the access token in hand, you can make regular API requests. To fetch a user's account info, for instance, the header looks like this:

Authorization: OAuth oauth_version="1.0", oauth_signature_method="PLAINTEXT",
oauth_consumer_key="<app-key>", oauth_token="<access-token>",
oauth_signature="<app-secret>&<access-token-secret>"

That same pattern applies to any endpoint in the API; just attach the same Authorization header. The request for account info is shown below:

GET https://api.dropbox.com/1/account/info