dropbox API error: invalid_access_token on long-lived token refresh

TL;DR

Stop using the long-lived token and switch to the refresh-token flow: exchange the refresh token for a short-lived access token, then keep refreshing on expiry. Dropbox retired long-lived tokens, so any code still holding one gets invalidaccesstoken. Refresh once, cache the short-lived token, refresh again when it expires.

dropbox API error: invalid_access_token on long-lived token refresh

Steps

1. Confirm your app has a stored refresh token (issued when the user authorized with offline access). Expected: you can find a refresh token in your credential store, not just the old access token.
2. Exchange the refresh token for a fresh access token by calling the Dropbox token endpoint with the refresh grant type, your app key, and your app secret. Expected: the endpoint returns a new short-lived access token.
3. Replace every stored use of the old long-lived token with the new short-lived token. Expected: no code path still sends the retired token.
4. Add refresh-on-expiry logic: when a call returns invalidaccesstoken or the token nears its expiry time, repeat the exchange automatically. Expected: the client recovers from expiry without manual steps.
5. Retry the original API call with the fresh token. Expected: Dropbox accepts the call and the error is gone.

Use this when

• Dropbox returns exactly "invalidaccesstoken" on a refresh attempt.
• The integration was built when Dropbox still issued long-lived tokens.
• Token refresh worked before and broke without a code change.

Not for this skill when

• The app key or app secret is wrong (that fails at the token endpoint differently).
• The user revoked access (refresh tokens stop working too; re-authorize instead).
• The provider is not Dropbox; other OAuth providers keep long-lived tokens.

Variant phrasings

• Dropbox refresh token returns invalidaccesstoken
• Dropbox long lived token no longer works
• Dropbox oauth token refresh invalid access token

Why it happens

Dropbox moved to short-lived access tokens plus refresh tokens and retired the old long-lived tokens. Generated clients built against the old model keep sending or trying to refresh the retired token, and the API answers invalidaccesstoken. The fix is the standard OAuth refresh flow, which the client simply never implemented.

Edge cases

• Refresh tokens can be revoked by the user or by Dropbox; when the refresh itself fails with invalid_grant, send the user through authorization again.
• The token endpoint needs the app secret, so this exchange must run server-side, never in browser code.
• Clock skew does not matter much here, but caching the expiry timestamp from the token response avoids refreshing on every call.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_RtkI1XZSr8oU023Xd9GpMg