Dropbox

Access files using the official Dropbox API with application credentials and a refresh token.

Adapter type: dropbox. See Common configuration for mounting instructions.

Setup

Create a Scoped access app in Dropbox App Console, choosing App folder or Full Dropbox.
Enable and submit files.metadata.read, files.metadata.write, files.content.read, and files.content.write.
Copy App key and App secret from Settings and register the callback used by your OAuth flow.
Follow the Dropbox OAuth guide, setting token_access_type=offline in the authorization request. Exchange the code with the same app credentials and callback, then save the returned refresh_token.
Reauthorize after changing permissions. A short-lived token generated in the console is not a refresh token.

Configuration

Field	Type	Required	Default	Description
`app_key`	string	Yes	—	Dropbox application App Key.
`app_secret`	password	Yes	—	Matching Dropbox App Secret.
`refresh_token`	password	Yes	—	Refresh token issued for this application and account.
`root`	string	No	`"/"`	Directory on the backend, separate from the mount path displayed in Foxel.
`timeout`	number	No	`60`	Request or connection timeout in seconds.
`enable_direct_download_307`	boolean	No	`false`	Allow HTTP 307 redirects to an upstream download URL; the client must be able to reach it.

Example

This is a config object. In the admin form, fill the corresponding fields rather than pasting the whole object. Replace credential placeholders with your own values.

json

{
  "app_key": "YOUR_APP_KEY",
  "app_secret": "YOUR_APP_SECRET",
  "refresh_token": "YOUR_REFRESH_TOKEN",
  "root": "/",
  "timeout": 60,
  "enable_direct_download_307": false
}

Behavior and limitations

For App folder apps, / is the app-specific directory. Full Dropbox paths are relative to the account root.
Use a Dropbox path for root, rather than a web URL.
Redirect mode uses a temporary download link with a limited lifetime; the client must reach Dropbox.

Troubleshooting

missing_scope: enable the needed permissions and reauthorize.
invalid_grant: confirm the token belongs to this app and authorization has not been revoked.
path/not_found: check the path is within the app’s allowed access scope.

References

External documentation provides service and authorization context. Use this page and the current Foxel adapter for configuration fields and limitations.