Table of Contents

Authentication

TTMSFNCCloudDropBox talks to Dropbox over OAuth 2.0, so every session starts by authenticating the user and obtaining an access token. You supply your Dropbox app's credentials on the Authentication object and call Connect to run the consent flow; enabling PersistTokens lets the same call reuse or silently refresh a previous session instead of prompting the browser every time. This chapter covers the credential setup, the connect flow, and persisting tokens across launches.

Dropbox app credentials

Create an app in the Dropbox App Console to get an app key and app secret, and register a redirect URI. Set the matching values on Authentication before connecting:

  • Authentication.ClientID — the app's app key.
  • Authentication.Secret — the app's app secret.
  • Authentication.CallBackURL — a redirect URI registered on the app (a local address such as http://127.0.0.1:8000 is typical for desktop apps).

Connecting

Connect opens the Dropbox consent page in the browser, then exchanges the returned code for tokens. Dropbox is asked for offline access, so the exchange also returns a refresh token. Handle OnConnected to know when the component is ready to make requests.

procedure TForm1.FormCreate(Sender: TObject);
begin
  // Credentials from your Dropbox app (https://www.dropbox.com/developers/apps).
  TMSFNCCloudDropBox1.Authentication.ClientID := 'your-dropbox-app-key';
  TMSFNCCloudDropBox1.Authentication.Secret := 'your-dropbox-app-secret';
  // Must match a redirect URI registered on the Dropbox app.
  TMSFNCCloudDropBox1.Authentication.CallBackURL := 'http://127.0.0.1:8000';

  TMSFNCCloudDropBox1.OnConnected := DropBoxConnected;
  // Opens the Dropbox consent page in the browser and exchanges the code for tokens.
  TMSFNCCloudDropBox1.Connect;
end;

procedure TForm1.DropBoxConnected(Sender: TObject);
begin
  // Tokens (including a refresh token) are now available on Authentication.
  TMSFNCCloudDropBox1.GetAccountInfo;
end;

Combining Connect with persisted and refreshed tokens

Connect already does more than run the interactive flow: it first loads any previously saved tokens, tests them, and — when the access token has expired but a refresh token is available — silently exchanges it for a new one before falling back to the browser. Setting PersistTokens.Section to a non-empty name turns this on: Connect then automatically saves Authentication.AccessToken, AccessTokenExpiry and AccessTokenRefresh (to an INI file by default; PersistTokens.Location also supports the registry or a database) and reloads them on the next Connect call, so a returning user with a still-valid or refreshable session never sees the browser again:

procedure TForm1.FormCreate(Sender: TObject);
begin
  TMSFNCCloudDropBox1.Authentication.ClientID := 'your-dropbox-app-key';
  TMSFNCCloudDropBox1.Authentication.Secret := 'your-dropbox-app-secret';
  TMSFNCCloudDropBox1.Authentication.CallBackURL := 'http://127.0.0.1:8000';

  // A non-empty Section switches on automatic token persistence: Connect
  // loads any saved AccessToken / AccessTokenRefresh, tests them, silently
  // refreshes an expired access token, and saves the (possibly refreshed)
  // tokens again on success.
  TMSFNCCloudDropBox1.PersistTokens.Section := 'MyAppDropBox';

  TMSFNCCloudDropBox1.OnConnected := DropBoxConnected;
  // Only opens the browser when there is no valid or refreshable session.
  TMSFNCCloudDropBox1.Connect;
end;

procedure TForm1.DropBoxConnected(Sender: TObject);
begin
  TMSFNCCloudDropBox1.GetAccountInfo;
end;
Note

PersistTokens writes to local storage in cleartext by default. For a deployed app, point PersistTokens.Location at a location your own encryption or OS keychain integration controls.

Common mistakes

  • Mismatched redirect URI. Authentication.CallBackURL must exactly match a redirect URI registered on the Dropbox app, or the consent flow fails.
  • Calling operations before OnConnected. Requests issued before the tokens are in place fail; start them from OnConnected.
  • Leaving PersistTokens.Section empty. LoadTokens/SaveTokens are a no-op when Section is empty, so tokens are silently not persisted and every Connect call requires the interactive browser flow again.

See also