Files & storage
Set up Dropbox
Dropbox is connected through your own Dropbox “app” — a credentials container you create in a couple of minutes; nothing is installed and nobody else approves anything. Three values end up pasted here: app key, app secret, refresh token.
Create the app
- At dropbox.com/developers/apps press Create app: Scoped access, Full Dropbox (or App folder, to expose only a sandbox folder), any name.
- On the Permissions tab tick files.metadata.read and files.content.read, then Submit.
- The Settings tab shows the App key and App secret.
Mint the refresh token
- In a browser open https://www.dropbox.com/oauth2/authorize?client_id=<App key>&response_type=code&token_access_type=offline — signed in as the account whose files should sync — and approve. The page shows a one-time code.
- Exchange it: POST https://api.dropboxapi.com/oauth2/token with code=<that code> and grant_type=authorization_code, authenticating with the app key and secret (curl -u APP_KEY:APP_SECRET -d code=… -d grant_type=authorization_code). The response carries the refresh_token.
- Documents → Dropbox: paste the app key, app secret and refresh token; optionally a folder path under Advanced (blank = the whole Dropbox); choose access groups, Test, then Sync.
The refresh token never expires on its own, and the source reads whatever the approving account can see — a Dropbox Business team space is swept too. The “Generated access token” button on the app page is a four-hour test credential, not a way to run.
Was this page helpful?
Last updated 29 Aug 2026