Dropbox integration in automations: OAuth refresh tokens and file upload guidance

Integrations
1

Hello Baserow team,

I’d like to build a workflow where researchers upload PDF files to Dropbox, and Baserow imports each file into the matching researcher’s record. The process will be started manually by a user, not on a schedule.

Dropbox’s API uses OAuth. You authorize the app once to get a long-lived refresh token, and the app then exchanges that refresh token for short-lived access tokens. I’d like to know how this can work within Baserow automations.

1. Authentication (OAuth refresh flow)

  • Can the Send an HTTP request action send form-encoded data, for the token exchange request?
  • Can it read a value (the access token) from a JSON response and use it in a later step?
  • How should the app key, app secret, and refresh token be stored, so they’re not exposed in workflow outputs or logs?

2. File upload

  • After downloading a PDF from Dropbox, how can the file be saved into a File field on a Baserow row?
  • Are there size or file-type limits for files added this way?

3. Documentation

  • Is there a guide for connecting Dropbox, or other cloud storage services, to Baserow automations?
  • If not, would one be possible to add?

Any pointers to existing guides or examples would be a big help.

Thank you,
Hiroshi

2

Hello @furutani.hiroshi.ren, we have this guide: Save email attachments automatically in Baserow :slightly_smiling_face:

Regarding this question:

You can find the answer in our user documentation:

I’ve also asked the development team to look into your authentication questions. Someone will get back to you about them.

3

Hi Hiroshi, regarding “Authentication”, here’s how the OAuth refresh flow works in Baserow automations today.

One-time setup (outside Baserow). Get a refresh token by opening this URL:

https://www.dropbox.com/oauth2/authorize?client_id=APP_KEY&response_type=code&token_access_type=offline

Approve the app, then exchange the code it shows you, once:

curl https://api.dropboxapi.com/oauth2/token \
  -d code=AUTH_CODE \
  -d grant_type=authorization_code \
  -u APP_KEY:APP_SECRET

The response includes a refresh_token. Dropbox refresh tokens don’t expire on their own and can be reused for every run, so you only do this once.

Step 1: get an access token. After your Manual trigger, add a Send an HTTP request action:

  • Method: POST
  • URL: https://api.dropboxapi.com/oauth2/token
  • Body type: Form Data, with four fields:
    • grant_type = refresh_token
    • refresh_token = your refresh token
    • client_id = your app key
    • client_secret = your app secret

Form Data is sent form-encoded, which is what Dropbox’s token endpoint expects. Click Test once. The JSON response is parsed, so body.access_token shows up in the data explorer.

Step 2: call Dropbox. In each later HTTP request, add a header Authorization with the value Bearer followed by the access_token from step 1, picked from the data explorer.

About the secrets. There’s no separate credential store for HTTP requests yet. The app key, secret and refresh token live in the action’s settings:

  • They aren’t saved in the run history.
  • They’re removed when the workspace is exported.
  • Anyone who can open the workflow can see them, so limit access to that workspace.

The access token returned in step 1 is saved in that node’s run results. It’s short-lived (the lifetime is in expires_in, usually a few hours), so keep access to the run history limited too. Don’t call Dropbox’s token revoke endpoint to clean up: it also disables your refresh token.

Cheers,

Peter