Dropbox access tokens, brokered from a stored refresh token.
Dropbox offers no API that mints a sub-credential, so this engine cannot be anything but a broker: it holds the one long-lived refresh token per authorisation and hands out four-hour access tokens. The consumer never sees the durable secret, which is the whole of the benefit.
The consequence worth internalising before reading further: because nothing is mintable, isolation between consumers comes from separate OAuth authorisations, not from this engine. One config document per consumer. Share one authorisation across several consumers and you lose the ability to revoke any of them independently — there is no server-side trick that recovers it.
See docs/delegation/dropbox.md for the mechanism and
docs/delegation/setup/dropbox.md for the operator walkthrough.