Questions about the usage limit of a refresh token (and access tokens)

---

Carl HR wrote:

... So, I just need a single account to store the data (the application will handle the downloads and uploads on the background).

 

From the OAuth Guide, I've been able to generate my own refresh token, and store it inside the python's script, as a string.

...

---

Hi Carl HR,

It's never good idea to share any credentials to/between users! Embedding refresh token (or any other type of such information, like access token, password, etc) will expose the same access to all and possible privacy violation. That's why better use a way to store such information somehow and instead of let users "won't know" that you're using API, let them sign in their own accounts so the information will be stored secure with guaranteed privacy. Alternative can be such access to be provided by you with your own web service that serve as a proxy between users and your own Dropbox account, so you have control who can access what.

---

Carl HR wrote:

...

In my current app version, I'm never storing any access tokens in the disk. Should I do it? I mean, should I store each access token in a file, so when the user opens a new instance of the application, it should attempt a connection using the Dropbox constructor with that loaded access token, and only use the refresh token if the access token has expired?

Or is it (morally) ok to use the refresh token every single time, and blindlessly allocate new access tokens at will (at every new instance of the application) even though they expire after 4 hours?

...

---

Good point. You can do it as you like. Dropbox doesn't mandate you to store access token, so you can skip it - it's not strictly needed. Such a way is suitable for applications and services where once run they stay running for relatively long time. For short running applications, like command line tools, where the application' instance runs for just a single (or few) API call, you can think for optimization (no meaningless refresh for every regular API call, that can slow down the work). Again it's not something mandatory. You can take a look here for example of such a simple optimization. Of course, you can do it better

Dropbox SDKs don't support saving access token and, if you decide, have to implement it yourself as you like (as implemented in the referred example for instance).

Hope this helps.