OAuth 2.0 Support for the Core API
The Core API now supports OAuth 2.0, which simplifies development and offers better support for mobile applications. The official Core API SDKs include OAuth 2.0 support, so using those libraries is the recommended approach. However, implementing the protocol directly is straightforward if you need that level of control.
The Core API supports two OAuth 2.0 grant types: the code grant for applications with a server-side component (such as web apps), and the implicit grant for client-side applications like mobile or JavaScript apps.
Code Grant Flow
Step 1: Begin authorization. Direct the user to an authorization URL:
https://www.dropbox.com/1/oauth2/authorize?client_id=<app key>&response_type=code&redirect_uri=<redirect URI>&state=<CSRF token>
Use the state parameter to prevent cross-site request forgery (CSRF) attacks. The SDKs generate a CSRF token by base-64 encoding a secure 16-byte random number and store a copy in the user's session.
Once the user authorizes your app, they are redirected to your redirect URI along with query parameters:
https://www.example.com/mycallback?code=<authorization code>&state=<CSRF token>Verify the CSRF token matches the stored value, then extract the authorization code for the next step.
Step 2: Obtain an access token. Exchange the authorization code for an access token by calling the /token endpoint. Here is an example using curl:
curl https://api.dropbox.com/1/oauth2/token -d code=<authorization code> -d grant_type=authorization_code -d redirect_uri=<redirect URI> -u <app key>:<app secret>
The response contains your access token:
{"access_token": "<access token>", "token_type": "Bearer", "uid": "<user ID>"}With this access token, you can make all Core API calls.
Step 3: Call the API. Attach the access token as a header on any request:
Authorization: Bearer <access token>For example, to retrieve information about the user's account using curl:
curl https://api.dropbox.com/1/account/info -H "Authorization: Bearer <access token>"
Implicit Grant Flow
Step 1: Obtain an access token. Direct the user to an authorization URL:
https://www.dropbox.com/1/oauth2/authorize?client_id=<app key>&response_type=token&redirect_uri=<redirect URI>&state=<CSRF token>
After authorization, the user is redirected to your redirect URI with parameters in the URL fragment (after the hash):
https://www.example.com/mycallback#access_token=<access token>&token_type=Bearer&uid=<user ID>&state=<CSRF token>Verify the CSRF token and extract the access token.
Step 2: Call the API. Use the access token exactly as in the code flow, with the Authorization: Bearer <access token> header.
Further Reading
Full details on OAuth 2.0 endpoints are available in the Core API documentation. The OAuth 2.0 specification is also a useful reference. For questions, visit the developer forum.
