Questions about the new features? Please the discussion on our forum. To get started, check out our updated OAuth Guide. Stay tuned for more migration guides and examples on the web. We’ll eventually retire these legacy types, but will provide ample notice and time for existing apps.Įxisting apps may choose to migrate their permissions to scopes in the App Console, or to incorporate PKCE and/or refresh tokens now. Our legacy app and token types are still selectable in the developer console for the time being. There is no change to existing apps, and you don’t need to immediately migrate. If you’ve already built (or are in the process of building) a Dropbox app, don’t worry. Using refresh tokens requires some additional code-but we’ve updated our SDKs to make this easy. Apps that require background access should be sure to use these. Using short lived access tokens with refresh tokens provides an additional level of security over longer-lived access tokens. If you’re building a desktop, mobile, single-page Javascript, open source, or any app being deployed to infrastructure you’re not managing, be sure to leverage this approach.įinally, we’ve also added support for refresh tokens. PKCE is an improvement over the older implicit grant for these types of applications. PKCE is an extension to the OAuth protocol that enables dynamic client secrets, designed for public clients that cannot guarantee safety of the client secret. You no longer have to build separate apps to support the User API and the Business API.Īpps built with scopes have new OAuth screens for communicating these permissions to end users.Īs part of this update, we’re also providing support for PKCE. With scopes, you can even ask for team permissions later.

Dropbox api get file permissions