HOW TO ACCESS DROPBOX FILES

The complete sample also includes callback validation, cleanup, cancellation, a sign-in timeout, and refresh-token handling.

The 'complete sample' is the sample https://github.com/dropbox/dropbox-sdk-dotnet?

Hi @Giorgio Sfiligoi ,

Sorry for the confusion. By “the complete sample,” I was referring to the .NET MAUI test implementation I created for this scenario, not the Dropbox GitHub sample.

The Dropbox GitHub sample was the reference for the OAuth/PKCE flow, while the MAUI-specific callback handling described in my answer is part of the implementation I tested on Windows and an Android emulator.

Thank you for pointing this out.

Thank you very much for your comprehensive reply. I am confident that your input will fix my issue; however, I am not sure how to implement it into the GitHub sample. Would you be so kind to provide me your 'complete sample' i.e. your test implementation?

Hi @Giorgio Sfiligoi , 

Thank you for the clarification. 

By the “complete sample,” I was referring to the .NET MAUI test implementation I used for this scenario, rather than another sample from the Dropbox GitHub repository. 

The implementation follows the same Authorization Code with PKCE approach, but adapts the callback handling for the MAUI platforms I tested. Windows uses a local loopback callback, while Android returns to the application through a platform-specific callback. 

Below are the project structure and the main implementation pieces from my test implementation. 

1. Project structure

I separated the authentication, Dropbox API, and UI responsibilities so that the platform-specific callback handling is easier to follow. 

MauiApp/ 
├── Services/ 
│   ├── Authentication/ 
│   │   ├── DropboxAuthService.cs 
│   │   ├── DropboxOAuthAttempt.cs 
│   │   ├── DropboxOAuthProtocol.cs 
│   │   ├── LoopbackOAuthReceiver.cs 
│   │   └── OAuthCallbackRouter.cs 
│   │ 
│   └── DropboxService.cs 
│ 
└── Platforms/ 
    └── Android/ 
        └── DropboxCallbackActivity.cs  

The main responsibilities are: 

• DropboxAuthService.cs: coordinates the authorization flow and session persistence. 
• DropboxOAuthAttempt.cs: creates the PKCE authorization attempt and holds the state, verifier, and callback information. 
• DropboxOAuthProtocol.cs: validates the callback and exchanges the authorization code and verifier for tokens. 
• LoopbackOAuthReceiver.cs: receives the Windows callback through the loopback address. 
• OAuthCallbackRouter.cs and DropboxCallbackActivity.cs: handle the Android callback. 
• DropboxService.cs: handles Dropbox file operations after authorization.  2. Authentication flow The main flow in DropboxAuthService is: 

public async Task SignInAsync( 
    string appKey, 
    CancellationToken cancellationToken) 
{ 
    var attempt = new DropboxOAuthAttempt( 
        appKey, 
        browser.RedirectUri); 
    var callback = await browser.AuthenticateAsync( 
        attempt, 
        cancellationToken); 
    var tokens = await protocol.ExchangeAsync( 
        attempt, 
        callback, 
        cancellationToken); 
    await PersistAsync(tokens); 
} 

This results in the following sequence: 

Create PKCE attempt 
→ Open Dropbox authorization page 
→ Receive platform callback 
→ Validate callback and state 
→ Exchange authorization code + verifier 
→ Persist the resulting session 
In my test implementation, the resulting token information is persisted using MAUI SecureStorage. 

3. PKCE token exchange 

Once the callback has been received and validated, the authorization code is exchanged using the original PKCE verifier: 

public Task<DropboxOAuthTokens> ExchangeAsync( 
    DropboxOAuthAttempt attempt, 
    Uri callback, 
    CancellationToken cancellationToken) 
{ 
    return RequestAsync( 
        attempt.AppKey, 
        new Dictionary<string, string> 
        { 
            ["grant_type"] = "authorization_code", 
            ["client_id"] = attempt.AppKey, 
            ["code"] = attempt.ReadAuthorizationCode(callback), 
            ["code_verifier"] = attempt.Verifier, 
            ["redirect_uri"] = attempt.RedirectUri.AbsoluteUri 
        }, 
        null, 
        cancellationToken); 
} 

 The application therefore does not need to embed an App Secret for this PKCE exchange. 

4. Windows callback 

For Windows, the test implementation uses a temporary loopback listener: 

using var listener = 
    new TcpListener( 
        IPAddress.Loopback, 
        attempt.RedirectUri.Port) 
    { 
        ExclusiveAddressUse = true 
    }; 
listener.Start(4); 
using var connection = 
    await listener.AcceptTcpClientAsync(cancellationToken); 
var stream = connection.GetStream(); 
// Read the HTTP request and reconstruct the callback URI. 
if (Uri.TryCreate( 
        attempt.RedirectUri, 
        firstLine[1], 
        out var candidate) 
    && attempt.MatchesCallback(candidate)) 
{ 
    return candidate; 
} 

 In my test implementation, this provides the callback directly to the PKCE flow without requiring index.html, JavaScript fragment forwarding, or the additional /token callback used by the original desktop implementation. 

5. Android callback

For Android, the test implementation uses a platform-specific callback rather than running the desktop-style local HTTP callback flow inside the emulator. 

The flow is: 

Dropbox authorization 
→ External browser 
→ Android callback URI 
→ DropboxCallbackActivity 
→ OAuthCallbackRouter 
→ Pending authentication attempt 
→ PKCE token exchange 

 DropboxCallbackActivity receives the callback URI and passes it to OAuthCallbackRouter, which completes the pending authentication attempt. 

This callback handling is the main platform-specific change I made when adapting the approach for MAUI. 

6. Dropbox operations after authorization

Once the access token has been obtained, the Dropbox API logic remains separate from the authentication flow: 

public async Task<DropboxPage> ListFilesAsync( 
    string accessToken, 
    string? cursor = null, 
    string folderPath = "") 
{ 
    var result = await ReadFolderAsync( 
        accessToken, 
        folderPath, 
        cursor, 
        200); 
    return new DropboxPage( 
        items, 
        result.HasMore ? result.Cursor : null); 
} 

The resulting access token can then be used with the existing Dropbox.Api operations for listing, reading, or downloading files. 

Verification scope

This reflects the implementation path I used for testing. I verified the authorization flow on Windows and Android emulator 

Physical Android devices, actual token expiration/refresh behavior, session restoration, and all cancellation scenarios were not part of the same end-to-end verification. 

The key difference from the Dropbox desktop sample is therefore not the PKCE concept itself, but how the OAuth callback is received and returned to the MAUI application on Windows and Android. 

I hope this helps clarify how I adapted the callback portion of the Dropbox sample for the MAUI test implementation. 

If you found my response helpful or informative, I would greatly appreciate it if you could follow this guide for your confirmation. 

With great effort, I am trying to reconstruct your code.

Sorry to bother you again, but I need a few clarifications:

1. In your DropboxOAuthProtocol, I think that 'DropboxOAuthTokens' is OAuth2Response in Dropbox.Api, and RequestAsync should be impemented by ProcessCodeFlowAsync - am I correct?
2. Your LoopbackOAuthReceiver.ReceiveAsync calls Uri.TryCreate(..., firstLine[1], ...) - I cannot figure what this 'firstLine' is.

Hi @Giorgio Sfiligoi ,

Thank you for working through the example. You are right that my earlier snippets omitted definitions you needed to follow the implementation. Sorry for the confusion.

To answer your questions directly:

DropboxOAuthTokens is not OAuth2Response. It is a model in my MAUI test project that holds the App key, access token, refresh token, and expiration time. RequestAsync is not ProcessCodeFlowAsync either. It is my own method for sending the token request and mapping the response into DropboxOAuthTokens.

Your suggested SDK approach is an alternative: PKCEOAuthFlow.ProcessCodeFlowAsync(...) performs the code exchange and returns OAuth2Response. If you use it, keep the same PKCEOAuthFlow instance for both GetAuthorizeUri(...) and ProcessCodeFlowAsync(...), because that instance holds the PKCE verifier.

using Dropbox.Api; 

var flow = new PKCEOAuthFlow(); 

var state = Guid.NewGuid().ToString("N"); 

var authorizeUri = flow.GetAuthorizeUri( 

    OAuthResponseType.Code, 

    appKey, 

    redirectUri.ToString(), 

    state: state, 

    tokenAccessType: TokenAccessType.Offline); 

// Open authorizeUri in the external browser. 

// Receive callbackUri using your Windows or Android callback handler. 

OAuth2Response result = await flow.ProcessCodeFlowAsync( 

    callbackUri, 

    appKey, 

    redirectUri.ToString(), 

    state); 

var accessToken = result.AccessToken; 

This is an SDK-based alternative to my custom token-exchange code, not a direct replacement of one method name with another. It also does not receive the browser callback for you; your MAUI app must obtain callbackUri first.

For your other question, firstLine is a local variable from my Windows loopback receiver. After reading the browser’s HTTP request into buffer, the code extracts the request line:

var request = Encoding.ASCII.GetString(buffer, 0, received); 

var firstLine = request.Split("\r\n", 2)[0].Split(' '); 

`` 

For example, if the request begins with:

GET /authorize?code=...&state=... HTTP/1.1 

then firstLine[1] is /authorize?code=...&state=.... The receiver uses that path and query to reconstruct the callback URI. The full receiver also needs to validate the request line before accessing [1]; these lines explain the variable rather than representing a complete HTTP listener.

The main difference in my MAUI test is callback handling: Windows receives the callback through a loopback listener, while Android returns it to a callback Activity. Once either platform has returned the callback URI, the authorization code can be exchanged for tokens. This approach does not use the desktop sample’s index.html, JavaScript fragment forwarding, or second local /token callback.

One correction to my earlier wording: the code you pasted uses OAuthResponseType.Token, but Dropbox’s separate OAuthPKCE example already uses Authorization Code with PKCE. I adapted the callback handling for MAUI, not the PKCE concept in that example.

Finally, my previous excerpts were not a complete, buildable sample, and I should not have described them that way. I hope this clarifies the missing definitions and helps you choose between my custom token-exchange code and the SDK helper.

If you found my response helpful or informative, I would greatly appreciate it if you could follow this guide for your confirmation.

Thank you.

Hi @Giorgio Sfiligoi ,

Just checking in to see how you’re getting on with the Dropbox authorization flow in your .NET MAUI project. Were the clarifications about DropboxOAuthTokens, RequestAsync, and firstLine helpful, or is there a specific part you’re still stuck on?

Please let me know what you’re seeing on your side, and I’ll be happy to help further.

Hi @Giorgio Sfiligoi ,

Since I haven’t received any recent updates, I’ll go ahead and close this thread for now. If you’re still working on the Dropbox authorization flow in your .NET MAUI app or run into any further issues, please feel free to reach out at any time. I’ll be happy to help.

Thank you.

I am indeed in a trouble.

RequestAsync is not ProcessCodeFlowAsync either. It is my own method for sending the token request and mapping the response into DropboxOAuthTokens.

Not having your RequestAsync and attempt.ReadAuthorizationCode that it calls, I tried to implement the procedure based on PKCEOAuthFlow, landing in the following:

internal class DropboxAuthentication
{
    public DropboxAuthentication()
    {
#if WINDOWS
        redirectUri = new Uri(RedirectUrlWindows);
#elif ANDROID
        redirectUri = new Uri(RedirectUrlAndroid);
#else
        throw new PlatformNotSupportedException("Unsupported platform");
#endif
    }

    // Authentication constants
    private const string appKey = "s7zoopx7puv6bs3";
    private const string RedirectUrlWindows = $"http://127.0.0.1:52475/authorize";
    //private const string RedirectUrlWindows = $"http://127.0.0.1/authorize";
    private const string RedirectUrlAndroid = "mauidropboxgs://oauth/callback";

    // sign-in
    private Uri redirectUri;

    private readonly string[] scopeList =
    {
        "files.content.read",
        "files.content.write",
        "files.metadata.read"
    };

    // Acquires a dropbox access token and saves it to the default settings for the app.
    public async Task SignInAsync()
    {
        var accessToken = await SecureStorage.GetAsync("AccessToken");
        if (string.IsNullOrEmpty(accessToken))
        {
            try
            {
                Debug.WriteLine("Waiting for credentials.");
                var state = Guid.NewGuid().ToString("N");
                Debug.WriteLine("State: {0}", state);
                var OAuthFlow = new PKCEOAuthFlow();
                var authorizeUri = OAuthFlow.GetAuthorizeUri(
                                OAuthResponseType.Code,
                                appKey,
                                redirectUri.ToString(),
                                state: state,
                                tokenAccessType: TokenAccessType.Offline,
                                scopeList: scopeList,
                                includeGrantedScopes: IncludeGrantedScopes.None);

                Uri callbackUri;
#if WINDOWS
                callbackUri = await LoopbackOAuthReceiver.ReceiveAsync(redirectUri, authorizeUri, OpenBrowserAsync, CancellationToken.None);
#elif ANDROID
                callbackUri = await OAuthCallbackRouter.ReceiveAsync(redirectUri, authorizeUri, OpenBrowserAsync, CancellationToken.None);
#else
                throw new PlatformNotSupportedException("Unsupported platform");
#endif

                Debug.WriteLine("Exchanging code for token");
                var tokenResult = await OAuthFlow.ProcessCodeFlowAsync(
                                callbackUri,
                                appKey,
                                redirectUri.ToString(),
                                state,
                                null);
#if DEBUG
                if (tokenResult.RefreshToken != null)
                {
                    Debug.WriteLine("RefreshToken: {0}", tokenResult.RefreshToken);
                }
                if (tokenResult.ExpiresAt != null)
                {
                    Debug.WriteLine("TokenResult ExpiresAt: {0}", tokenResult.ExpiresAt);
                }
#endif
                Debug.WriteLine("Persisting tokens to secure storage");
                await SecureStorage.SetAsync("AccessToken", tokenResult.AccessToken ?? String.Empty);
                await SecureStorage.SetAsync("RefreshToken", tokenResult.RefreshToken ?? String.Empty);
                await SecureStorage.SetAsync("ExpiresAt", tokenResult.ExpiresAt?.ToString() ?? String.Empty);
            }
            catch (Exception ex)
            {
                Debug.WriteLine("Error: {0}", ex.Message);
            }
        }
    }

Notice that I modified ReceiveAsync to accept redirectUri and authorizationUri rather than 'attempt'; following is my complete implementation:

    public static async Task<Uri> ReceiveAsync(Uri redirectUri, Uri authorizationUri, Func<Uri, Task> openBrowserAsync, CancellationToken cancellationToken)
    {
        using var listener = new TcpListener(IPAddress.Loopback, redirectUri.Port)
        {
            ExclusiveAddressUse = true
        };
        listener.Start(4);
        await openBrowserAsync(authorizationUri);
        //** 127.0.0.1 refused to connect **
        using var connection = await listener.AcceptTcpClientAsync(cancellationToken);
        var stream = connection.GetStream();
        MemoryStream memstream = new MemoryStream();
        await stream.CopyToAsync(memstream, cancellationToken);
        int received = Convert.ToInt32(memstream.Length);
        byte[] buffer = new byte[received];
        if (memstream.Read(buffer, 0, received) != received)
        {
            throw new InvalidOperationException("Failed to read the entire request.");
        }
        var request = Encoding.ASCII.GetString(buffer);
        var firstLine = request.Split("\r\n")[0].Split(' ');
        // Read the HTTP request and reconstruct the callback URI. 
        if (Uri.TryCreate(redirectUri, firstLine[1], out var candidate)
            && MatchesCallback(redirectUri, candidate))
        {
            return candidate;
        }
        else throw new InvalidOperationException("Invalid callback URI received.");
    }

WINDOWS:

It goes through the two Dropbox sign-in pages (Continue and Allow), then it gets stuck. When I close my program, I am left with a browse page saying '127.0.0.1 refused to connect'

ANDROID:

For the time being I have not tried to implement OAuthCallbackRouter and DropboxCallbackActivity.