Build the authorize URL for your app and include the offline access option so Dropbox knows to issue a refresh value alongside the access value.

Exchange the authorization code at the Dropbox token endpoint as soon as it arrives, using your app key and app secret for a standard server side app, or the code verifier for a PKCE app.

Store the refresh value in your app secret store, separate from any access value you keep in memory.

When an API call returns an expired access error, post the refresh value with a refresh grant to the token endpoint and use the new access value it returns.

Test the full cycle once in a staging app by forcing an access expiry and confirming the refresh call succeeds.