HOW TO ACCESS DROPBOX FILES

Thank you very much for your comprehensive reply.

For an initial test with your own Dropbox account, you can generate an access token from the OAuth 2 section of your Dropbox app settings.

This is exactly the point!

Following is the code that should do the job, taken from the sample https://github.com/dropbox/dropbox-sdk-dotnet:

using Dropbox.Api.Files;
using Dropbox.Api;
using System.Net;
using System.Text;
using System.Threading.Tasks;

namespace TestDropbox;

public static class Dropbox
{
    // Authentication constants

    // Add an ApiKey (from https://www.dropbox.com/developers/apps) here
    private const string ApiKey = "XXXXXXXXXXXXXXX";

    // This loopback host is for demo purpose. If this port is not
    // available on your machine you need to update this URL with an unused port.
    private const string LoopbackHost = "http://127.0.0.1:52475/";

    // URL to receive OAuth 2 redirect from Dropbox server.
    // You also need to register this redirect URL on https://www.dropbox.com/developers/apps.
    private static readonly Uri RedirectUri = new Uri(LoopbackHost + "authorize");

    // URL to receive access token from JS.
    private static readonly Uri JSRedirectUri = new Uri(LoopbackHost + "token");

    // ------------------------------------------------------------------------

    /// <summary>
    /// Gets the dropbox access token.
    /// </summary>
    public static async Task GetAccessToken()
    {
        var accessToken = Preferences.Get("AccessToken", String.Empty);
        if (string.IsNullOrEmpty(accessToken))
        {
            try
            {
                var state = Guid.NewGuid().ToString("N");
                var authorizeUri = DropboxOAuth2Helper.GetAuthorizeUri(OAuthResponseType.Token, ApiKey, RedirectUri, state: state);
                var http = new HttpListener();
                http.Prefixes.Add(LoopbackHost);
                http.Start();
                await Browser.OpenAsync(authorizeUri);

                // Handle OAuth redirect and send URL fragment to local server using JS.
                await HandleOAuth2Redirect(http);

                // Handle redirect from JS and process OAuth response.
                var redirectUri = await HandleJSRedirect(http);
                var result = DropboxOAuth2Helper.ParseTokenFragment(redirectUri);
                http.Stop();

                if (result?.State != state)
                {
                    // The state in the response doesn't match the state in the request.
                    //return;
                    throw new Exception("The state in the response does not match the state in the request.");
                }

                // save Access token
                Preferences.Set("AccessToken", result.AccessToken);
                Preferences.Set("Uid", result.Uid); // NOT USED
            }
            catch (Exception ex)
            {
                string message = ex.Message;
                if (message == "Invalid OUath 2.0 response, missing access_token and/or uid.")
                {
                    message = "CANCELED BY USER";
                }
                await Shell.Current.DisplayAlertAsync("Exception in GetAccessToken", message, "OK");
            }
        }
    }

    /// <summary>
    /// Handles the redirect from Dropbox server. Because we are using token flow,
    /// the local http server cannot directly receive the URL fragment. We need to
    /// return a HTML page with inline JS which can send URL fragment to local
    /// server as URL parameter.
    /// </summary>
    /// <param name="http">The http listener.</param>
    /// <returns>The <see cref="Task"/></returns>
    private static async Task HandleOAuth2Redirect(HttpListener http)
    {
        var context = await http.GetContextAsync();

        // We only care about request to RedirectUri endpoint.
        while (context.Request.Url?.AbsolutePath != RedirectUri.AbsolutePath)
        {
            context = await http.GetContextAsync();
        }

        context.Response.ContentType = "text/html";

        /*
         * Respond with a page which runs JS and sends URL fragment as query
         * string to TokenRedirectUri.
         */
        using (var file = File.OpenRead("index.html"))
        {
            file.CopyTo(context.Response.OutputStream);
        }

        context.Response.OutputStream.Close();
    }

    /// <summary>
    /// Handle the redirect from JS and process raw redirect URI with fragment to
    /// complete the authorization flow.
    /// </summary>
    /// <param name="http">The http listener.</param>
    /// <returns>Uri</returns>
    private static async Task<Uri?> HandleJSRedirect(HttpListener http)
    {
        var context = await http.GetContextAsync();

        // We only care about request to TokenRedirectUri endpoint.
        while (context.Request.Url?.AbsolutePath != JSRedirectUri.AbsolutePath)
        {
            context = await http.GetContextAsync();
        }
        var query = context.Request.QueryString["url_with_fragment"];
        var redirectUri = new Uri(query!);
        return redirectUri;
     }
...

The file index.html (also from the sample above) is:

<html>
<script type="text/javascript">
    function redirect() {
        // Append fragment as query string so that server can receive it.
        document.location.href = "/token?url_with_fragment=" + encodeURIComponent(document.location.href);
    }
</script>
<body>
    onload="redirect()"
</body>
</html>

This works for the sample, which is a console desktop application, but not in MAUI with the emulator:

• WindowsMachine: gets stuck on the browser page reading 'onload="redirect()"'; closing the page does not solve
• Android emulator: gives error "127.0.0.1 refused to connect"

Thus, I cannot get the access token.

Hi @Giorgio Sfiligoi ,

Thank you for sharing the additional details and code sample. This gives me a much clearer picture of the issue. I’ll take a closer look and give you an update as soon as possible.

Thank you for your patience.

Hello @Giorgio Sfiligoi , I am Nguyen, Harry's colleague, will be assisting you today on behalf of him as he is currently off duty.

From my research, I found that in your code contains the following snippet, which may cause the issue:

using (var file = File.OpenRead("index.html"))
{
    file.CopyTo(context.Response.OutputStream);
}

Please replace it with the following code:

using (var file = await FileSystem.Current.OpenAppPackageFileAsync("index.html"))
{
    await file.CopyToAsync(context.Response.OutputStream);
}

It may have caused the issue as File.OpenRead may not be able to find index.html through a normal file-system path, and you would need to use OpenAppPackageFileAsync which is designed to access MAUI assets. Important Note: Before re-building the application, please try to ensure first that index.html is placed under Resources/Raw. Please let me know if the issue still occurs after making this change.

I made this change - same as before.

Hi @Giorgio Sfiligoi ,

Thank you for clarifying the requirement and for sharing your implementation.

I understand that you want users to connect and authorize their Dropbox account directly from the .NET MAUI application, rather than manually generating and entering an access token.

I reproduced the scenario and tested an alternative approach successfully on Windows and an Android emulator. The implementation uses the Authorization Code flow with PKCE, with callback handling configured separately for each platform.

Updated authentication flow

The original desktop sample requests the access token through the implicit token flow. It then uses index.html and JavaScript to forward the URL fragment to a local listener.

The tested implementation uses the following flow instead:

Connect
→ Generate state and PKCE verifier/challenge
→ Open Dropbox authorization in the external browser
→ Receive the platform-specific callback
→ Validate the callback and state
→ Exchange the authorization code and verifier for tokens
→ Store the session with MAUI SecureStorage
→ Use the access token with Dropbox.Api

This removes the need for index.html, JavaScript fragment forwarding, and the second /token callback.

Dropbox app configuration

In the Dropbox App Console:

• Enable and submit files.metadata.read.
• Enable and submit files.content.read.
• Enter the Dropbox App key in the MAUI application.
• Register the exact redirect URI used by each platform.

The redirect URIs used in my test were:

Windows:
[http://127.0.0.1:52475/authorize](http://127.0.0.1:52475/authorize)

Android:
mauidropboxtutorial://oauth/callback

The redirect URI passed in the authorization request must match its registered value exactly.

This implementation does not require an embedded App secret or a manually generated access token.

Create the PKCE authorization request

Each authorization attempt generates a new state, verifier, and SHA-256 challenge:

var parameters = new Dictionary<string, string>
{
      ["client_id"] = appKey,
      ["response_type"] = "code",
      ["redirect_uri"] = redirectUri.AbsoluteUri,
      ["state"] = state,
      ["code_challenge"] = CreateChallenge(Verifier),
      ["code_challenge_method"] = "S256",
      ["token_access_type"] = "offline",
      ["scope"] = string.Join(" ", DropboxOAuthOptions.Scopes)
};

AuthorizeUri = new Uri("[https://www.dropbox.com/oauth2/authorize]       (https://www.dropbox.com/oauth2/authorize)?" +
string.Join("&", parameters.Select(pair =>
$"{Uri.EscapeDataString(pair.Key)}=" +
$"{Uri.EscapeDataString(pair.Value)}")));

The verifier remains in the application and is used later during the token exchange.

Handle the callback per platform

The shared authentication service delegates callback handling to the appropriate platform implementation:

public Task<Uri> AuthenticateAsync( DropboxOAuthAttempt attempt, CancellationToken cancellationToken)
{
#if WINDOWS
return LoopbackOAuthReceiver.ReceiveAsync( attempt, OpenBrowserAsync, cancellationToken);
#elif ANDROID
return OAuthCallbackRouter.ReceiveAsync( attempt, OpenBrowserAsync, cancellationToken);
#else
throw new DropboxAuthenticationException( "OAuth is configured only for Windows and Android in this sample.");
#endif
}

On Windows, a temporary loopback listener is started before the browser opens. It receives the authorization code at /authorize.

On Android, a callback Activity handles:

mauidropboxtutorial://oauth/callback

The Activity forwards the callback URI to the pending authentication attempt. No local HTTP listener runs inside the Android emulator.

The Dropbox authorization page is opened in the external browser:

private static Task<bool> OpenBrowserAsync(Uri uri) => MainThread.InvokeOnMainThreadAsync( () => Browser.Default.OpenAsync( uri, BrowserLaunchMode.External));

Exchange the authorization code

After validating the callback and state, the application exchanges the authorization code and PKCE verifier for tokens:

var parameters = new Dictionary<string, string>
{
      ["grant_type"] = "authorization_code",
      ["client_id"] = attempt.AppKey,
      ["code"] = attempt.ReadAuthorizationCode(callback),
      ["code_verifier"] = attempt.Verifier,
      ["redirect_uri"] = attempt.RedirectUri.AbsoluteUri
};

These parameters are sent as form-encoded content to the Dropbox OAuth token endpoint.

The resulting session is stored with MAUI SecureStorage rather than Preferences. OAuth requests use HttpClient, while Dropbox file operations continue to use Dropbox.Api.

The complete sample also includes callback validation, cleanup, cancellation, a sign-in timeout, and refresh-token handling. The snippets above illustrate the main flow and are not standalone replacements for your existing class.

About the original implementation

The earlier suggestion to load index.html with OpenAppPackageFileAsync is still relevant if you continue using the original HTML-based flow.

Also, if the actual HTML file is structured exactly as shown in your comment:

onload="redirect()"

then onload="redirect()" is displayed as text rather than executed as an event handler. It would need to be placed on the opening tag:

However, the PKCE implementation described above does not require this HTML file.

I have not established the exact cause of the original Android 127.0.0.1 refused to connect error. The tested replacement avoids that dependency by returning to an Android callback Activity instead of using an emulator-local HTTP server.

Verification scope

I verified that authorization completes and returns a usable access token on Windows and Android emulator.

Session restoration, actual token expiration and refresh, all cancellation paths, and physical Android devices should still be validated separately before using the implementation in production.

If you found my response helpful or informative, I would greatly appreciate it if you could follow this guide for your confirmation.

Thank you.

The sample https://github.com/dropbox/dropbox-sdk-dotnet is a console application for desktop. It runs ok - except that the browser remains open after the sign-in process has completed.

I created a MAUI project with code from that sample, but:

• WindowsMachine: it stucks on the redirection browser page
• Android emulator: I have an error "129.0.0.1 refused to connect"

The document https://developers.dropbox.com/oauth-guide is an old document, dated December 07, 2020 and it does not provide any help for implementation in MAUI.

Dropbox API Explorer: it is of no help for developing MAUI applications.

I will check latest one and update to you