Migrating App Permissions and Access Tokens

This post details the migration of Dropbox's OAuth system to scoped apps, introducing short-lived access tokens, PKCE, and refresh tokens. It guides developers on reviewing and deselecting unnecessary scopes, determining required scopes by listing API endpoints and their required scopes, and programmatically setting scopes via the authorization URL. It also explains how to test and update the access token type to short-lived, and how to implement refresh tokens for offline access. The post announces the upcoming retirement of long-lived tokens.