title: Dropbox Core API for file uploads
body: <p>I run a service that is visited by its users to generate PDF documents that are then delivered to them by email. I am in the process of exploring an alternative delivery route - popping the prepared document directly in a Dropbox folder that they designate.</p>
  
  <p>After a spot of research I discovered the <a href="https://www.dropbox.com/developers-v1/core/start/php" rel="nofollow">Dropbox API</a> and then played with their "explorer" <a href="https://dropbox.github.io/dropbox-api-v2-explorer/#upload" rel="nofollow">here</a>.  Examining the cURL they generate to perform a file upload I found that it could quite easily be done with a spot of PHP.  After creating a new app I then wrote out a little PHP script</p>
  
  <pre><code>$headers = array('Authorization: Bearer ul...',
                    'Content-Type: application/octet-stream',
                    'Dropbox-API-Arg: {"path":"/test.txt","mode":"add"}');
  $data = 'Betty bought a bit of butter';
  
  $ch = curl_init('https://content.dropboxapi.com/2-beta-2/files/upload/');
  curl_setopt($ch,CURLOPT_HTTPHEADER,$headers);
  curl_setopt($ch,CURLOPT_POST,true);
  curl_setopt($ch,CURLOPT_POSTFIELDS,$data);
  curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
  $response = curl_exec($ch);
  curl_close($ch);
  echo $response;
  </code></pre>
  
  <p>On running this script everything worked just perfectly - the file in question turned up in my Dropbox in a fraction of a second.</p>
  
  <p>All very nice.  However, I am into my first few minutes with the Dropbox API and there is much that I do not understand here</p>
  
  <ul>
  <li>Is the code I wrote above by blindly mimicking their explorer sample code the right way to do file uploads?</li>
  <li>In my case it is the users of my service who will have to provide me with a valid App token I can use above in the <code>Authorization:Bearer...</code> bit. I assume that this token constrains me to only working within the confines of their <em>app</em> folder?  They would, naturally, be unwilling to hand over a token that lets me do what I will with their Dropbox. *Needless to say - this would be conditional on their configuring their "App" permission type to <em>App Folder</em>.</li>
  </ul>
  
  <p>I'd much appreciate any feedback I can get on my approach - particularly the flaws in it - from those who know the Dropbox API better than I.</p>