Build a Dropbox Sign OAuth app that lets end users create and send signature requests on their own behalf (embedded requesting)

Steps

1. Create an API app in the Dropbox Sign account settings, configuring the OAuth callback URL, event callback URL, and OAuth scopes.
2. Send the user to the OAuth authorization endpoint with response_type=code, client_id, state, and redirect_uri; after consent, exchange the returned code for a token via the OAuth token endpoint (grant_type=authorization_code, client_id, client_secret, code, state).
3. Using the resulting bearer access token, create a draft signature request as that user via the unclaimed-draft create-embedded endpoint (add is_for_embedded_signing to suppress signer emails); the response includes a claim_url.
4. On the client, install the Dropbox Sign embedded JS library and call its open method with the claim URL and options such as clientId and skipDomainVerification to render the create/edit/send flow in an iframe on your domain.
5. Store the refresh_token and call the OAuth token endpoint with grant_type=refresh_token to renew the short-lived access token without re-prompting the user.
6. Submit the app for Dropbox Sign production/app approval before going live — embedded requesting, embedded signing, and OAuth all require approval; test mode works pre-approval.