- How do I install stevenmaguire/oauth2-dropbox in a Laravel app?
- Run composer require stevenmaguire/oauth2-dropbox and construct the provider with your clientId, clientSecret, and redirectUri from the Dropbox App Console. There is no Laravel service provider, config file, or facade in this package, so nothing is auto-discovered and nothing needs registering. Instantiate the provider in a controller or a small auth service and run the standard authorization-code flow.
- Does this package support token refresh and Dropbox short-lived access tokens?
- The provider itself is a thin adapter, so the refresh grant is handled by league/oauth2-client via getAccessToken('refresh_token', [...]), not by this package. Dropbox switched to short-lived access tokens (about four hours) plus refresh tokens in late 2021, so confirm the provider adds token_access_type=offline to the authorization request; if it does not, add that parameter yourself. Always persist the refresh token, since the access token will expire quickly.
- Which league/oauth2-client versions and Laravel versions does it support?
- The package carries no framework coupling, so it works on Laravel 8 through 11 on PHP 8.0+ as long as Composer resolves a compatible league/oauth2-client. The last release was 2021-09-16, so validate the declared league/oauth2-client constraint against the 2.x version your app actually resolves, especially 2.7+. Run composer require on a feature branch and confirm the solver does not downgrade the client used by the rest of your app.
- Does stevenmaguire/oauth2-dropbox support PKCE?
- PKCE support lives in league/oauth2-client, not in this provider, so it depends on the client version your app resolves and how you call getAuthorizationUrl and setPkceCode. Dropbox requires PKCE for apps that do not have a client secret, which makes this a real constraint if you are building a public or mobile client. Test the full PKCE flow in a Dropbox sandbox app before committing to the package.
- How do I get the Dropbox user's account info with this provider?
- Call $provider->getResourceOwner($accessToken)->toArray(), which targets Dropbox API v2's /2/users/get_current_account endpoint and requires the account_info.read scope. The mapping exposes fields such as account_id, name.display_name, and email based on a 2021-era response shape. Verify each field still exists in the current API response before you persist it to your users table.
- What scopes does the Dropbox provider request by default?
- The provider ships a default scope set and requires account_info.read for getResourceOwner to succeed. Keep the scope list minimal in your Dropbox App Console app and add only what the product actually needs. If you are using refresh tokens, also make sure the authorization request includes token_access_type=offline alongside your scopes.
- Is stevenmaguire/oauth2-dropbox still maintained and safe for production?
- It has a single maintainer, 16 stars, no visible CI or test signal, an unknown repository location, and a last release date of 2021-09-16, which means a bus factor of one. The code still installs and works as a thin provider adapter, but you should expect to own fixes and verify the user mapping and token behavior yourself. Plan for a maintained fork or an in-house replacement if upstream goes quiet.
- Should I use this package or the Laravel Socialite Dropbox driver?
- If your Laravel app already uses Socialite, do not introduce a second OAuth abstraction for one provider; use socialiteproviders/dropbox so login, token handling, and user hydration stay behind one interface. Choose stevenmaguire/oauth2-dropbox only when league/oauth2-client is already your house standard. Either way, normalize the result into a single internal identity value object so switching later is invisible downstream.
- How do I handle Dropbox API errors and failed token exchanges with this provider?
- Error semantics depend on the provider's checkResponse implementation, which decides whether a 401 from Dropbox surfaces as a typed exception or an opaque bubble. Wrap getAccessToken and getResourceOwner calls in try/catch and log the raw error payloads during a sandbox spike. That one test tells you whether you need to add error mapping on top of the provider.
- What are the alternatives to stevenmaguire/oauth2-dropbox?
- The main options are Socialite with socialiteproviders/dropbox, a roughly 100-line in-house GenericProvider subclass over league/oauth2-client, or a maintained community fork. Price the decision on total flow ownership, including token refresh, token storage, PKCE, and user mapping, rather than on the provider class itself. For a one-provider Laravel app, consolidating on Socialite is usually the lower-risk path.