benweet/stackedit · error · Error

Dropbox account ID not expected.

Error message

Dropbox account ID not expected.

What it means

After a Dropbox OAuth2 exchange, startOauth2 compares the Dropbox account_id returned by the API with the `sub` claim embedded in the issued app token. A mismatch means the account that completed authorization is not the account the token was issued for, so dropboxHelper throws at src/services/providers/helpers/dropboxHelper.js:86 to prevent storing credentials for the wrong identity.

Source

Thrown at src/services/providers/helpers/dropboxHelper.js:86

        response_type: 'token',
      },
      silent,
    );

    // Call the user info endpoint
    const { body } = await request({ accessToken }, {
      method: 'POST',
      url: 'https://api.dropboxapi.com/2/users/get_current_account',
    });
    userSvc.addUserInfo({
      id: `${subPrefix}:${body.account_id}`,
      name: body.name.display_name,
      imageUrl: body.profile_photo_url || '',
    });

    // Check the returned sub consistency
    if (sub && `${body.account_id}` !== sub) {
      throw new Error('Dropbox account ID not expected.');
    }

    // Build token object including scopes and sub
    const token = {
      accessToken,
      name: body.name.display_name,
      sub: `${body.account_id}`,
      fullAccess,
    };

    // Add token to dropbox tokens
    store.dispatch('data/addDropboxToken', token);
    return token;
  },
  async addAccount(fullAccess = false) {
    const token = await this.startOauth2(fullAccess);
    badgeSvc.addBadge('addDropboxAccount');
    return token;

View on GitHub (pinned to 6dce2a5e36)

Solutions

1. Log out of other Dropbox accounts (or use a private window) and reconnect so the same account completes authorization.
2. Clear stored tokens for the provider and restart the OAuth flow from scratch.
3. Ensure the `sub` passed to startOauth2 comes from the same token exchange, not a stale saved token.
4. Retry the sign-in flow; if it persists, check for proxy/session rewriting of the OAuth response.

Example fix

// before
if (sub && `${body.account_id}` !== sub) {
  throw new Error('Dropbox account ID not expected.');
}
// after
if (sub && `${body.account_id}` !== sub) {
  console.warn(`Dropbox account mismatch: expected ${sub}, got ${body.account_id}`);
  throw new Error(`Dropbox account ID not expected (authorized ${body.account_id}, expected ${sub}). Sign in with the correct account.`);
}

function storedSubMatches(expectedSub) {
  const saved = readSavedProviderToken('dropbox');
  return !saved || !saved.sub || saved.sub === expectedSub;
}

function isDropboxAccountMismatch(err) {
  return err instanceof Error && /account ID not expected/i.test(err.message);
}

try {
  await dropboxHelper.startOauth2(...);
} catch (err) {
  if (isDropboxAccountMismatch(err)) {
    clearStoredTokens('dropbox');
    promptReauthInFreshSession();
  }
}

When it happens

Trigger: `${body.account_id}` !== sub during startOauth2: the OAuth token's sub does not match the account_id from the Dropbox profile call — e.g. the user switched Dropbox accounts between token issuance and authorization, or a stale/cached token sub was reused.

Common situations: User has multiple Dropbox accounts and the browser session lands on a different one; re-auth flow reusing an old token's sub with a new account's login; cookie/session mixups in shared browsers.

Related errors

• GitHub account ID not expected.
• The authorize window was blocked.
• GitLab account ID not expected.
• Google account ID not expected.
• WordPress account ID not expected.

AI-assisted analysis of benweet/stackedit@6dce2a5e36 (2026-09-01). Data as JSON: /api/errors/406ea72a18dcf8fb. Report an issue: GitHub.