Skip to main content
Dropbox uses a webhook receiver (paid runtime).

​
Webhook receiver (paid runtime)

Dropbox uses a two-step webhook pattern: a GET challenge for verification, then POST notifications.
Signature: Dropbox signs POST payloads with X-Dropbox-Signature (HMAC-SHA256 of the raw body using the app secret). The receiver validates the HMAC.

​
Setup

  1. Create a Dropbox App at dropbox.com/developers. Use Scoped access, full Dropbox or app folder.
  2. In the app settings, add https://runtime.myceliumai.co/webhooks/dropbox/{your_tenant_id} as a webhook URI.
  3. Required permissions: files.metadata.read, files.content.read, sharing.read.
  4. Add to the runtime env:
    • DROPBOX_APP_KEY_{TENANT_ID}
    • DROPBOX_APP_SECRET_{TENANT_ID} (used for signature validation and OAuth)
    • DROPBOX_REFRESH_TOKEN_{TENANT_ID} (long-lived OAuth 2.0 refresh token)

​
Events ingested

Dropbox webhooks only signal that changes occurred for a user; the runtime fetches the delta via the /files/list_folder/continue endpoint on notification.

​
Retry behavior

Failed deliveries land in the per-tenant dead-letter folder. Replay via: