Upload Files from Zoho Creator to Dropbox with Deluge

Push Zoho Creator Files to Dropbox

Creator storage is not the cheapest place to keep a decade of signed authorisation letters. Push them to Dropbox instead, named from the record so they are findable, and keep only the path in Creator.

Three separate things in the original are dead. First, it called Dropbox API v1 (api.dropbox.com/1/save_url/), which Dropbox retired years ago — not just the auth, the entire API version. Second, it used a long-lived access token; Dropbox stopped issuing those on 30 September 2021 and now requires short-lived tokens refreshed from a stored refresh token, with a scoped app. Third — and this is the one nobody expects — it shortened the file URL through the Google URL Shortener, which shut down in 2019 and whose links stopped resolving entirely in August 2025. Three dead dependencies in one twenty-line function.

There is a live credential in the original. The 2018 script carries an unmasked Dropbox bearer token hardcoded in the header map. If you have a copy of the original anywhere, revoke that token in the Dropbox App Console. Everything below uses named placeholders.

Before you start

  • A scoped app in the Dropbox App Console with the files.content.write scope.
  • A refresh token. Authorise once in a browser with token_access_type=offline, then store the refresh_token in a DBX_Token form.
  • A Zoho OAuth connection named creator_oauth_connection to fetch the file.

Deluge functions

// ============================================
// ZOHO CREATOR -> DROPBOX
// Short-lived token minted from a stored refresh token.
// ============================================

string Dropbox.getAccessToken()
{
    APP_KEY    = "YOUR_DROPBOX_APP_KEY";
    APP_SECRET = "YOUR_DROPBOX_APP_SECRET";

    stored = DBX_Token[ID != null] sort by Added_Time desc range from 0 to 1;

    body = Map();
    body.put("grant_type","refresh_token");
    body.put("refresh_token",stored.Refresh_Token);
    body.put("client_id",APP_KEY);
    body.put("client_secret",APP_SECRET);

    resp = invokeurl
    [
        url    : "https://api.dropboxapi.com/oauth2/token"
        type   : POST
        parameters : body
        headers: {"Content-Type":"application/x-www-form-urlencoded"}
    ];

    token = resp.getJSON("access_token");
    if(token == null)
    {
        info "Dropbox auth failed: " + resp.toString();
        return "";
    }
    return token;
}

void Dropbox.uploadFile(int recordId)
{
    rec = Soluciones[ID == recordId];

    if(isBlank(rec.Carta_Autorizacion))
    {
        info "No file on record " + recordId;
        return;
    }

    token = thisapp.Dropbox.getAccessToken();
    if(token == "")
    {
        return;
    }

    // 1. Pull the file out of Creator through an OAuth connection
    fileObj = invokeurl
    [
        url  : "https://creatorapp.zohopublic.com/YOUR_ACCOUNT/YOUR_APP/report/Soluciones_Report/"
               + recordId + "/Carta_Autorizacion/download"
        type : GET
        connection : "creator_oauth_connection"
    ];

    // 2. Dropbox-API-Arg must be ASCII-only JSON
    extension = rec.Carta_Autorizacion.getSuffix(".");
    path = "/" + rec.MID + "/Carta-Autorizacion-" + rec.No_Poliza + "." + extension;

    apiArg = "{\"path\":\"" + path + "\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}";

    headerMap = Map();
    headerMap.put("Authorization","Bearer " + token);
    headerMap.put("Content-Type","application/octet-stream");
    headerMap.put("Dropbox-API-Arg",apiArg);

    resp = invokeurl
    [
        url    : "https://content.dropboxapi.com/2/files/upload"
        type   : POST
        files  : fileObj
        headers: headerMap
    ];

    uploadedPath = resp.getJSON("path_display");
    if(uploadedPath != null)
    {
        rec.Dropbox_Path = uploadedPath;
        info "Uploaded to " + uploadedPath;
    }
    else
    {
        info "Dropbox upload failed: " + resp.toString();
    }
}

Notes

  • No URL shortener needed. The original shortened a link because it used save_url, which asked Dropbox to go and fetch the file itself. Uploading the bytes directly is simpler, faster, and removes both the shortener and the public link from the picture.
  • Dropbox-API-Arg must be ASCII. An accented filename — Autorización, say — breaks the header. Either transliterate it or escape it as ó. This bites hard in Spanish-language apps.
  • Access tokens last about four hours. Mint one per run from the refresh token, as above. Do not try to cache one for days.
  • Files over 150 MB need a different endpoint — /2/files/upload_session/start, /append_v2, /finish. The simple upload will reject them.
  • autorename saves you from collisions. With mode: add and autorename: true, a repeat upload becomes file (1).pdf rather than an error. Use mode: overwrite only when you are certain you want the old version gone.

This script is part of the free Creator Scripts Deluge Library.

All 39 Deluge scripts, the full Zoho Creator course, and every downloadable asset are now free. Get free access →