Dropbox Watchdog

Search issues

Search the Dropbox Watchdog archive

All issues

Unpublished rate limits and write throttling that stall integrations

Ongoing

MediumStatus: OngoingProduct: Dropbox APIYear: 2023

Dropbox enforces rate limits it does not publish, returning HTTP 429 errors — including a separate too_many_write_operations limit triggered by parallel writes to the same folder — that can throttle backup tools and bulk integrations without warning.

What happened

Dropbox's API enforces rate limiting but does not publish the exact thresholds, telling developers only that the limits 'are not designed to inhibit normal applications.' When an app exceeds them, calls return HTTP 429 with reason too_many_requests and a Retry-After header indicating how long to wait. For developers that means limits can be hit unexpectedly, and the remedy — back off, batch, and optimize call patterns — must be discovered empirically rather than designed against a documented quota.

A second, separate throttle catches write-heavy integrations: writing to a file first acquires a lock on its namespace (folder tree), and enough parallel writes to the same namespace create lock contention, returning HTTP 429 with reason too_many_write_operations. Backup, migration, and sync tools that fan out parallel uploads into one shared folder are exactly the workloads that trip this, and the documented fix (upload sessions, batch endpoints, serialized commits) again requires re-engineering. The opacity of the limits — no published numbers — makes capacity planning for large integrations a matter of trial and error.

Impact

Undisclosed limits and namespace write-contention errors are a persistent friction point for anyone building data-movement tooling on Dropbox. They surface as intermittent failures that are hard to reproduce and force developers to add retry/backoff and batching logic, raising the cost and fragility of integrations — a recurring complaint in Dropbox developer forums.

Dropbox's Response / Official Position

Dropbox publishes a 'DBX Performance Guide' and 'Error Handling Guide' describing 429 handling, the Retry-After header, the too_many_write_operations reason, and recommended use of upload sessions and batch endpoints — while declining to publish specific rate-limit numbers, stating only that they should not affect well-behaved apps.

Sources

Related guides

Spot an error, or have a source to add?
Report an error / suggest update

Related issues

2 sources
Medium

2026 root-certificate change forces SDK upgrades or apps lose API access

Because some official Dropbox SDKs pinned root certificates, Dropbox's switch to a new certificate root starting 1 January 2026 means apps on the Java, .NET, or Python SDK must upgrade to specific minimum versions or lose access to the API.

Current / Ongoing Issues (2024–2026)Developer, API & Platform
Read documentation

Dash connects to Google Workspace, Microsoft 365, Slack, Notion and more, and routes queries through large language models — leaving users to trust Dropbox's contractual assurances that connected and indexed data is not used to train third-party AI models.

Privacy & Encryption ConcernsCurrent / Ongoing Issues (2024–2026)Developer, API & Platform
Read documentation

A tracked vulnerability in the Dropbox desktop application for Windows could strip the 'Mark of the Web' flag from synced files, weakening a key warning that protects users from running downloaded, untrusted content.

Security Incidents & Data BreachesDeveloper, API & Platform
Read documentation

The HelloSign API was rebranded to the Dropbox Sign API in 2022, and after the 2024 Dropbox Sign breach the company rotated API keys and OAuth tokens — meaning developers who had embedded e-signature functionality had to update credentials and re-establish connections, not just rename a product.

Current / Ongoing Issues (2024–2026)Developer, API & Platform
Read documentation