Dropbox API + MCP vs OneDrive and SharePoint files (Microsoft Graph)

Dropbox API + MCP

Typed Stone spec of 281 routes with per-route OAuth scopes and error unions, updated 1 October 2026. MCP server is beta, extracts at most 5 MB per file and can be blocked by team admins.

OneDrive and SharePoint files (Microsoft Graph)

One REST surface covers personal OneDrive, work OneDrive and SharePoint libraries, with resumable uploads, sharing links that take an expiry date and per-file Selected permissions. The status page needs JavaScript, an app must be registered and consented to by a person, and the JavaScript client on npm lacks a token-leak fix merged in June 2026.

Dropbox API + MCP

1. Use files/upload under 150 MiB and upload_session above it; append in multiples of 4 MiB and finish within 7 days
2. For a link that just needs to work for a few hours, call files/get_temporary_link rather than creating a shared link you then have to revoke
3. Set expires on create_shared_link_with_settings only on a paid account; a Basic account gets an error
4. Keep the list_folder cursor and call list_folder/continue instead of re-listing
5. On a rate-limit error wait retry_after seconds; too_many_write_operations means write contention, so serialise writes

OneDrive and SharePoint files (Microsoft Graph)

1. Use PUT /content only up to 250 MB. Above 10 MiB Microsoft advises createUploadSession, with fragments in multiples of 320 KiB and under 60 MiB each
2. Send the bearer token on the createUploadSession POST only. The PUT calls to uploadUrl can return 401 if an Authorization header is included
3. Set expirationDateTime and scope on createLink. Without a scope the tenant's default link type is created, which may be wider than intended
4. Follow the 302 from GET /content straight away. Pre-authenticated download URLs can expire within minutes and need no Authorization header
5. Wait for Retry-After on 429 and 503. Throttled requests still count against the limits, and continued overuse can get the app blocked