title: Access user folder on dropbox without compromising token?
body: <p>We are creating an app where every user has a designated dropbox folder which is located in a dropbox folder created only for the app. The user should have only access to his own folder. </p>
  
  <p>The problem is with the created API access token you have access to all folders of all users. In our app we are able to restrict the access so the user has only access to his own folder but because the access token must be hard coded into the web app anyone could eventually get hold of it. With the access token they would have access to all user folders (and the client data would be unsecured).</p>
  
  <p>So there are two possibilities:</p>
  
  <ol>
  <li>We access Dropbox via PHP and restrict the access. The app gets the user folder per AJAX and the PHP script handles the restrictions. But there is no possibility to access Dropbox via PHP (in API v2).</li>
  <li>The data is stored on the users own Dropbox accounts, but we don't want the users to need an own Dropbox account to get access to our app functionalities. And the company should always have access to all user folders.</li>
  </ol>
  
  <p>Is there any possibility to encrypt and hide the access token in the javascript code? Or are there other ways to solve this problem?</p>